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FOREWORD 


As a follow-up of the Space Transportation System Technology Symposium held 
at the NASA-Lewis Research Center, Cleveland, Ohio, July 15-17, 1970, a series of 
discipline- oriented conferences was planned, with the Office of Advanced Research and 
Technology/Office of Manned Space Flight (OART/OMSF) Space Shuttle Integrated Elec- 
tronics Technology Conference being held at the NASA Manned Spacecraft Center, 
Houston, Texas, May 11-13, 1971. The Conference goal was to present a timely review 
of the status of Space Shuttle technology in the major areas of electronics and power 
systems for the benefit of the industry, Government, university, and foreign partici- 
pants considered to be contributors to the program. In addition, the Conference 
offered an opportunity to identify the responsible individuals already engaged in the 
program. The Conference sessions were intended to confront each presenter with his 
technical peers as listeners, and this was substantially accomplished. 

Because of the high interest in the material presented, it is being published es- 
sentially as it was presented, utilizing mainly the illustrations used by the presenters 
along with brief words of explanation. The document is unclassified, and each of the 
authors has determined that his paper can be published in this manner. This publica- 
tion is aimed at revealing the substance and significance of the work in this manner 
now, rather than in a more refined form much later. 
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INTRODUCTION 


A. O. Tischler 

National Aeronautics and Space Administration 
Washington, D. C. 


The main purpose of having opening remarks for a conference is, of course, to provide an opportunity for 
latecomers to be seated before anything really begins to happen. Let me use a few minutes to tell those of you 
already seated something about this meeting. 

This conference is the fourth of a series of four spring conferences on the technology effort supporting the 
Shuttle Program. Our recent conferences at the Langley Research Center, at Phoenix in connection with the AIAA 
meeting, and at the Marshall Space Flight Center have examined the technological questions of the shuttle in all the 
major areas except electronics and power systems. This conference therefore completes the circle of reviews, 
although not the work to be done, nor the results still to be obtained. In contrast to the meeting at Cleveland about 
10 months ago, most of these meetings have presented results and hard data on which to build the discussion. I 
trust that this meeting, too, will be able to consider real results instead of plans. Proceedings of all of these will 
be published and will therefore be available for your study and use. 

This conference is on the general subject of electronics and electrical power systems for the shuttle. I 
know something about what an electron is, but how to build machinery which makes all those little things work to- 
gether is to me a little baffling. Nevertheless, I know that the demands of the shuttle systems for automatic check- 
out, continuous monitoring of systems, automatic fault isolation, computer-driven displays, data-busing, and 
relegation of flight control procedures and functions to an avionics system without jeopardizing the reliability of 
the vehicle itself constitutes an enormous total program, even though I sense that the technology of individual 
pieces of that total problem are fairly well in hand. These are among the things that this conference will cover 
or uncover, and I am sure that anything else I say about them can be labeled superfluous. 

At the Langley meeting Charles Donlan, OMSF's Acting Shuttle Program Manager, reviewed the time frame- 
work for the Shuttle Program. Many of you are quite familiar with that and with its relation to the Shuttle Tech- 
nology Program. Others, however, are not. It may be worth the time to use a couple of charts to provide this 
background orientation for the ensuing discussions. 

The first chart shows the shuttle development schedule as planned by the Office of Manned Space Flight. 
Selection of a contractor to build the long-lead shuttle engines is already under way. The phase B and continuing 
phase A studies carried out by various airframe contractors will end on June 30. Requests for proposals to de- 
velop the shuttle vehicle system will be issued this fall. Contractor selection will be made by spring. Phase C 



will begin then, with phase D, which represents a final commitment to the design of the shuttle, to begin about a 
year later. 

Note two dates also shown on the schedule. One is labeled the PDR, which stands for preliminary design 
review. This occurs in early 1973. At this point the contractor must make all his initial commitments to design 
approach. However, he may put off absolute final design decisions until the CDR, or critical design review. This 
occurs in early 1974. After that, any continuing technological work on approaches other than specified by the con- 
tractor is for backup or product improvement, or else we're in deep trouble with this schedule. 


NASA SCHEDULE 
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The technological work represented on the next chart, where it is categorized by working group activities, 
indicates that some technological work continues into CY 1974. This doesn't violate my prior statement if the 
contractor's design choices are in harmony with the technical efforts Indicated. Of course, no overview chart, 
such as this one, can portray the real picture. To do that requires a project-by-project review of the work. We 
have laid out the technological work on a project-by-project scheduling basis, with a view to matching technologi- 
cal work end-points with the dates the contractors will need results in order to build them into their designs. 


SHUTW TCCHMOlOeiES 





I am confident that our engineering teams will be able to hold up their end of this total job when the time 
comes to do so. I don't know what the limit of our NASA and industry capabilities really is because that limit has 
never really been tested before, and we've done some remarkable things. I do know that the Technology Program, 
which draws together the efforts, both in-house and contracted, of our research, our space flight centers, and DOD 
is now making real progress in spite of jurisdictional problems that occur when strong-willed project people en- 
counter strong-minded research personnel. I am confident that in developing cooperation and communication chan- 
nels across organizational boundaries we are building a stronger people base and technological base than we had to 
undergird previous programs. 

The growing knowledge of the technological status of the problems relating to the total vehicle system has 
two dimensions. One, which we can call either height or depth, is obviously the identification and verification of 
new ideas, designs, techniques, and the like. The other is breadth. There is an increasing number of people in 
the centers and in the contractors' plants who are becoming currently and correctly aware of the best present 
technology. Pay attention to that. In this complex technological world, it's a rare idea indeed that can be de- 
scribed as unique. However, in our democratic approach to accepting new ideas, it's also a rare day when one 
or two technologically astute individuals get an opportunity to outvote a more pragmatic project office. The point 
I'm really driving at, however, is that the broadening of our technical base among involved people is as important 
to the successful development of a truly low-operating-cost transporation system as the deepening of that informa- 
tional base among a few specialists. This program represents my attempt to make those two groups talk and 
listen to each other to develop experience without the usual procedure of "doing it over. " To accomplish this end, 
the Technology Program and its organization have been designed to penetrate the walls of the organizational box 
from which project planning, development, and operations have traditionally been conducted. At the same time, 
that box is opened for others to observe and adapt the methods and results of the learning process to their own 
technical problems. 

By setting up these conferences with participation of in-house, contractor, and even non-aerospace people, 
we are exposing the work, the results, and our thinking about them to all who are potential contributors to the 
shuttle program. We are also, in a broader sense, promoting the widest spread of shuttle-oriented technology 
as part of a national up-grading process, in which some of these ideas may be applied in less glamorous, and 
probably more profitable, business ventures. Thus, we are fulfilling the national interest to advance modern 
science and technology and to extract from the benefits it holds for this country's economy, education, and stand- 
ard of living. 

If this can be said about the Shuttle Technology Program in its entirety, then it can be underscored for the 
electronics and power systems part of it. In the work covered by this conference, I see future technological 
transfers not only to general aviation but also to commercial use of the sensing, data transfer and digestion, com- 
puter read out, and communications equipment stemming from this program. The areas of electronic communi- 
cation and data handling already account for about 5 percent of this nation's gross national product and have every 
prospect for continued growth. 



Having thus amplified a few shuttle electrons to the scale of the gross national product, let me readjust the 
gain back to this conference. I want to avail myself now of this opportunity to thank Bob Gilruth and his staff for 
providing this fine facility. I also want to thank Bob Gardner, who was my debating partner in school about 
35 years ago, for his work as conference chairman. My thanks also to Cline Frasier who, as chairman of the 
electronics working group, was instrumental in establishing the program you're going to hear about. Cline is 
about to undertake a sojourn at the Massachusetts Institute of Technology in New England. I wish him well. His 
chairmanship of the electronics working group will be taken over by Cliff Bradford of this center. 

Now, I believe we've come to the time when I call again on my old partner to flesh out my opening remarks. 
Bob, it's your show — please take over. 
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DEVELOPMENT PROGRAM PLANNING FOR 
SHUTTLE AVIONICS 

D. M. Petrie 

The Boeing Company 
Seattle, Washington 


SUMMARY 


The development program, management techniques, and special tools that are unique to the integrated avionics 
concept being advanced by the Space Shuttle are described. Emphasis is placed on the test beds and facilities 
that are necessary to negotiate the interdisciplinary problem that threatens the success of the integrated design 
approach. Among the facilities required are an integrated avionics demonstrator, a test bed airplane, a mission 
control/GSE van, and an "iron bird" with operating subsystems. These requirements are related to the special- 
ized tools necessary to support discrete technology developments. The calendar phasing and typical costs of 
these facilities are described. 



INTRODUCTION 


The "integrated" concept being advanced for the space shuttle electronics is in danger of foundering unless certain key 
elements of this approach have gained the willing support of the affected technology factions. The interdisciplinary 
cooperation that is required will not come readily, - even if autocratic management directives are employed; rather, 
a carefully developed research program, that is aimed at this problem, will evolve the required methodology. 

Before discussing such a research program, it is appropriate to review why the integrated approach is necessary. In 
a typical airplane, 25% of the gross take-off weight is payload. In contrast, the shuttle payload is approximately 1% 
of the launch weight. Accordingly, shared usage of wiring, computers, sensors, displays, and radio links, being one 
way to reduce the inert weight fraction, can have a strong affect on the transportation efficiency of the vehicle. The 
involvement of fewer subcontractors is also believed to be an effective way to reduce equipment and maintenance costs, 
presuming the development costs peculiar to the integrated approach do not grow disproportionately, when compared with 
the conventional non-integrated approach. Another reason to go "integrated" is that the overhead costs associated with 
Ground Support operations and Mission Control, as now practiced in the Apollo Program, represent a significant fraction 
of the cost/pound of payload delivered to orbit. Data collection, processing, and navigation are simplified by 
centralizing many of these functions within the vehicle. This is known as "operational autonomy." 

Another reason to select a more advanced approach for a government -financed program, when a choice is available. 

Is the more abstract need to keep the program sold to the weary taxpayer. For example, the subsystem management 
techniques and mission control methods being advanced for shuttle have a direct corollary to, respectively, plant automa- 
tion and future air traffic control procedures. Data bus techniques will also help show the way to better utilization of phi 
lines and the 300 Mhz bandwidth of cable TV: remote reading of utilities (gas, power, water), bedside medical data 

pickup, and facsimile print-out of library material. 



DEVELOPMENT PROGRAM PLANNING FOR SHUTTLE AVIONICS 


WHY GO "INTEGRATED" ? 

• LOWER OPERATIONAL COSTS, WEIGHT, AND DDT&E 

• ADVANCE ELECTRONIC TECHNOLOGY FOR COMMERCIAL FALL-OUT 

HOW IMPLEMENTED ? 

• ONBOARD CHECKOUT, MONITORING, AND MISSION CONTROL 

• SHARED USAGE OF EQUIPMENT 

MAJOR HURDLE 

• INTERDISCIPLINARY COMMUNICATION 
HOW RESOLVED 

• SYSTEMS ENGINEERING DIRECTORATE 

t • MULTI -TECHNOLOGY DEVELOPMENTAL TEST BEDS 


UNI-TECHNOLOGY TEST BEDS 


There is generally a high correlation in any given program between the engineering organization chart, the hardware 
architecture, and the laboratory facilities. As a means to introduce the multi-technology test beds that are the main 
topic of this paper, it is important to differentiate between the developmental facilities involving several technologies 
and those that are primarily oriented to support the activities of one technology group. 


The facing page shows the familiar simulations, mockups, and breadboard hardware that are used to aid discrete technology 
developments. Frequently, a test bed, that was originally intended to stay within the meets and bounds of one group's 
organizational charter, expands and overlaps the function of a technically adjacent test bed. A classic example is the 
flight control system. Initially, a simulation of the airframe flight dynamics and related control laws of the flight control 
electronics is set up on a general-purpose computing facility. Only mathematic models of the hardware are involved at 
the outset. Eventually, a breadboard version of the flight control electronics replaces the simulated control laws. 


In a separate development, the redundant hydraulic actuation system for the aerodynamic mode of control is connected to 
a dynamic equivalent of the surfaces and the surrounding attachment structure. Next, a need for actuator load equalization 
within the servo drive section of the flight control electronics appears; and aerodynamic hinge moment data from the flight 
dynamics math model is needed to physically load the actuation test rig. A marriage of these two test beds is now 
appropriate. If this is not done, the group responsible for actuation may be motivated to develop their own flight dynamics 
simulation and load equalization electronics. 

In a similar example, a group responsible for CRT displays development may be motivated to design a complete flight deck 
and crew station, - the latter also being done by a Human Factors technology group. The need to eventually combine 
these test beds again appears. Eventually, the pilot handling qualities experiments being done with the aforementioned 
flight control simulator will need to be combined with the crew station/display breadboard. As the test bed integration 
process continues, the technology groups find themselves competing for time and emphasis on the multi-purpose test beds. 

This further motivates the discrete technology groups to want to "do their own thing" in a uni-technology development 
facility that is dedicated to their work charter. The duplication of effort that results is not 100% bad; what is important, 
however, is that we openly discuss this problem in the context of what it means to the "integrated" concept for shuttle 
electronics. That is, the uni-technology cliquishness that is normally present forms a natural resistance to going "integrated." 


None of the above, of course, is news: the problem exists whether we go "integrated" or "non-infegrated." The message 

here is that the shared usage of equipment, as required for the "integrated" way, will increase the interdisciplinary 
communication problem to a level that can make the more experienced management people despair. 



UNI-TECHNOLOGY TEST BEDS 




MULTI-TECHNOLOGY TEST BEDS 


The key to selling the integrated approach is demonstrated success of the integrated concept, using a number of carefully 
devised developmental (not prototype) test bedTl These test beds are of the breadboard variety, with plenty of freedom 
to try new ideas as they evolve: only the gross objectives need be established to prevent their progress from going 
astray. The test results are used as "feeders" to the baseline designs, providing confidence to either proceed or to retract 
from the new features of the integrated approach, where field experience is now lacking. 

The facing chart shows the four test beds that are clearly of the multi-technology type. The calendar phasing shown is 
intended to support the mainstream Phase C/D effort, with the First Manned Orbital Flight (FMOF) scheduled in April, 1978. 

It should be noted that one of the objectives of the Integrated Avionics Demonstrator (IAD) is to develop the equipment and 
interfaces that will later be installed in the avionics test bed airplane. The correlation is not one-for-one, however, because 
the emphasis and calendar phasing within these two test beds is different. For example, installing a digital Fly-By-Wire 
flight controller is the first logical step in the airplane program. This can be enabled by a uni-technology development 
sub-program. This is followed by installation in the airplane of manually-monitored sensors of the second -gene rat ion landing 
aid that is required for the operational orbiter. In the meantime, displays and controls that have been previously developed 
in a uni -technology effort are being integrated with the data management computers, bus, and simulated subsystems of the 
IAD. Further downstream, test anomolies uncovered in the airplane program are analyzed on the IAD for corrective action. 
And so on. 

Similarly, the Mission Control/GSE Van is initially used for ground support of the autoland phase of the airplane program. 
Later, a digital data link with associated data processing equipment is added to the Van to begin exploration of the extent 
to which the autonomous Mission Control concept is practicable. 

The Iron Bird is the most complete assembly of operating subsystems that is considered practical, short of a Ground Test 
Vehicle. The segment of this facility, known as the Integrated Avionics Test Fixture, utilizes interdisciplinary experience 
gained on the IAD, but contains prototype avionics, rather than breadboard equipment. 



MULTI-TECHNOLOGY TEST BEDS 



CALENDAR TIME 











INTEGRATED AVIONICS DEMONSTRATOR 


This test bed, acronymed IAD, is an extension of the flight simulators that we have seen on most aerospace programs 
over the past 20 years. 

The order of facility buildup can vary; however, in a typical phasing, it begins with a long-period flight trajectory 
simulation, to study the dynamic interactive affects of winds, navigation accuracy, guidance laws, and structural 
heating. Non-electronic technologies are obviously involved at this stage. Eventually, the first-order lag used to 
simulate the flight control system is replaced by the math model of the short-period flight dynamics and its associated 
control system, these having been previously developed on a uni-technology test bed. 

The next major phase involves the addition of breadboard hardware to replace the math models. Again, the sequence 
can vary, but typically, a cab with working displays and controls is now added to give the astronaut group a realistic 
feel of the "machine" and their interfaces with it. Next, a central computer and data bus are added in conjunction 
with working models of the subsystems that must be actuated, monitored, and checked out by the Data Management 
Computer. As a general rule-of-thumb, these models of the Environmental Control and Life Support System (ECLSS), 
Attitude Control Propulsion System (ACPS), and the various hydro-mechanical actuators should cost no more than 1% 
of the real article. The purists among us may question the validity of such crude models. Others may wince at the 
Barnum and Bailey flavor that attends such a noisy and visually active array of equipment. But there are those of us 
from Missouri who have to be shown. And students of the learning process assure us that these simple audio-visual aids 
are nourishing. 

Later, the breadboard version of the flight control electronics and, perhaps, a strapdown IMU, mounted on an articulated 
table, are added. The modulation, decoding, and tuning section of the data link can be added in a final phase of 
the hardware buildup. We eventually have a breadboard version of the Integrated Avionics Test Fixture that is an 
anticipated requirement of the Phase C/D SOW. 

The facing page shows the physical organization of the simulation equipment and flight hardware. Note that a duplicate 
version of the equipment labeled "avionics" in the Vehicle Equipment Room is destined to be installed in the avionics test 
bed airplane; and that modified versions of the flight path plotter, mission control computer and mass memory units in the 
Math Model Simulations room are destined to be installed in the Mission Control/GSE Van. 














AVIONICS TEST BED AIRPLANE 


The objectives of this test bed must be carefully delineated relative to the objectives of the IAD, lest unnecessary 
duplication and phasing conflicts occur. Because flight testing costs run about $10,000/hour, only those features of the 
shuttle system that cannot be satisfactorily demonstrated on the ground are assigned to the airplane test bed. Many of the 
tests are not addressed to avionics matters, per se, even though avionics are always involved. Crew training for manual 
energy management of the unpowered orbiter, operational procedures for certain failure modes, and the utility of 
aerodynamic speed brakes are typical non-avionic tests. 

An avionics test bed has been used on the C-5, using a C— 1-41 , and, is planned for the B-l. There have also been 
numerous other flying test beds involving only critical elements of the avionics system, e.g. BOMARC, AWACS, and 
every autoland effort. 

The airplane should be large enough to accommodate a dozen test engineers and visitors, in addition to the avionics 
equipment. 

A somewhat new approach to flight testing an experimental avionics system is considered necessary for shuttle. In the 
past, a "tack-on" approach has been used for testing a specific device. If this process continues, a disorderly arrangement 
eventually results, and reliability and serviceability are disappointing. Instead, a palletized cab, installed through a cargo 
door, will permit fabrication and modification of the assembly in the superior environment of the laboratory. Installation 
of the cab amidships in the airplane, electrically attached to power sources, electro-mechanical elements and antennas 
via umbilicals permits a relatively "clean" operation. Another reason for this design approach is that the extensive use of 
multi-purpose CRT displays and keysets in the shuttle crew station area make the patchwork approach most awkward. And 
no pilot has yet shown much willingness to take off in an airplane with a complete new nose job, - fly-by-wire and all, 
without having something familiar to fall back on when something goes wrong. Placing the new cab above the original 
one (747 style) involves major surgery to the airplane and degrades the serviceability feature of the palletized cab. 

The data management computer used for guidance/navigation, and for provision of data to the display processor, is located 
in a 1 foot deep sandwich section added beneath the floorboards of the cab used in the IAD. Inertial navigation, 
multiplex data bus, data link, and R.F. Navaid equipments are also located in this avionics bay. 

The autoland system that is tested, immediately after the fly-by-^wire flight controller development phase, is compatible with 
what the Radio Technical Commission for Aeronautics has tentatively selected for commercial aviation in the post-1 980's era. 

Out-the-windscreen viewing is provided by two vidlcons mounted above and below the standard cab. 



AVIONICS TEST BED AIRPLANE 



PALLETIZED CAB WITH INTEGRAL AVIONICS MODULE INSTALLED AMID SHIPS 
SECOND-GENERATION AUTOLAND CONCEPT (RTCA 117) 

ENERGY MANAGEMENT OF GLIDING ORBITER 
CREW TRAINER FOR OPTIONAL MANUAL MODES 


MISSION CONTROL/GSE VAN 


The primary purpose of the Van is to provide ground-based support to the airplane test bed. Initially, it is not meant to be 
a test bed for the Mission Operations Project (managed by MSC) or the Launch Operations Project (managed by KSC) antici- 
pated for shuttle. However, many of the elements of the mission control function, and a few of the elements of the GSE 
function, are desirable adjuncts to this test bed. The Van can be loaded aboard a C-130 transport, giving it mobility 
for testing at any proposed landing or ferry site. 

Early tests involve only the K^-band scanning beam autoland ground station. Addition of a data link permits demonstration 
of the multi-purpose data/voice link. Next, addition of one display for flight path monitoring and another for remote 
readout of any display available to the flight crew will begin to demonstrate how far the Manned Spaceflight Network 
(MSFN) can be streamlined. The potential of this Van to show the way to lowering the cost of the current MSFN is 
enormous, particularly if license to do so can be arranged. 

Bulk storage of trajectory constants and mission options, that have been developed in a separate mission planning operation, 
is included to demonstrate the commonality between shuttle mission control and air traffic control of the post-1985 era. 

Finally, data from other tracking and communication centers are brought into the Van via phone lines for further demon- 
stration of the more autonomous method of mission control intended for shuttle operations. 


to 
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MISSION CONTROL/GSE VAN 



• Ml SSION CONTROL DEMONSTRATOR OF "AUTONOMOUS" OPERATION 

• GROUND SUPPORT EQUIPMENT FOR PREFLIGHT MONITOR & TEST 

• TELEMETER, COMMUNICATION, AND AUTOLAND R.F. AIDS 




IRON BIRD 


A final stage of testing, prior to horizontal flight tests with the actual orbiter and booster, is with all vehicle equipment 
operating together in a Systems Integration Laboratory (SIL) or Iron Bird. (The name "Iron Bird" derives from the I-beam 
and angle-iron type of structure used to simulate the mass and compliance of the structural elements). Although the 
initial purpose of this test bed is the development of hydro-mechanical and electro-mechanical actuation devices, the 
ultimate purpose is to ferret out the subsystem interaction problems. It should be noted that avionics is only one of 
several subsystems being played together on this test bed. Combustive operation of the rocket and airbreathing 
propulsion systems are obviously not practical here, - limited operation of the attitude control propulsion system (ACPS) 
may be practical in an adjacent, isolated test cell; however, the value/cost ratio is not likely to support such testing 
here. 

In aircraft using mechanical cables for actuator signalling, the iron bird must be essentially the same size as the full- 
scale vehicle; because friction, hysterisis, and compliances must be adequately simulated. In the case of the SST, the 
building housing this facility is the size of a football field. For shuttle, fly-by-wire obviates the need for such physical 
scaling; however, in order to minimize the number of surprises in the flight test program, it is desirable to locate equip- 
ments in a physical proximity similar to that in the full-scale vehicle. Electro-magnetic interference and hydro-mechanical 
cross-talk are problems that can be expected to be initially troublesome, because so much of the avionics employs pulses 
in its operation, and there are complex, redundant hydraulic equipments. 

A special feature that can be implemented in a facility of this type, - especially if the planning is done early in a 
given program, - is the clustering together of the uni-technology and multi-technology test beds in such a way that a 
common computer complex results. This is shown as the "flight simulation complex" on the facing drawing. 

The buildup of prototype avionics equipment is similar to that done on a more experimental basis in the IAD: the math 

model simulations of the avionics subsystems are gradually replaced by prototype units (not necessarily flight-rated) as 
they become available. 




TYPICAL COSTS 


A credible estimate of the costs of these four multi-technology test beds is, of course, a major undertaking. The 
costs shown are scaled from some similar Boeing programs, and are only meant to be typical and relative. The actual costs 
of these individual facilities are very sensitive to the level of detail required to simulate the item under investigation, 
and the thoroughness felt necessary to prove or disprove the issue at hand. For example, a feasibility experiment, done 
early in a program, can be much less costly than development of the same equipment at the prototype stage. This is 
common knowledge, but the point needs to be kept in mind when detailing those parts of the shuttle electronics 
development program that need to be undertaken in order to assure success of the integrated/autonomous concept. 

The first three test beds listed on the facing page were costed in a research program begun in the Commercial Airplane 
Division of Boeing in January 1967. The aggregate costs for this 3 1/2 year program were estimated to be $5.5M, 
based on cost sharing support from the avionics industry and use of a Company-owned airplane. Economic downturns 
in the commercial aviation industry have since forced a stretch-out and reorientation of this program and, consequently, 
there is scant evidence to grade our estimating ability. Nevertheless, this estimate is still useful as a relative yarkstick, 
because 55 man-months were spent in planning this program. Comparison with other similar programs in the industry at 
large is beyond the scope of this paper, but would provide an interesting additional set of data points for planning 
purposes of the NASA shuttle program. 

S* The cost estimates for the Iron Bird were based on the SST CODE (Controls Development) facility, which was well over 

half-completed at the time of program cancellation. However, the cost estimate shown is for an austere version, the 
original estimate being $22M. 



TYPICAL COSTS 


INTEGRATED AVIONICS DEMONSTRATOR *2.2M 


PURCHASED EQUIPMENT 
TEST PROGRAM 

$Q.9M 

$L3M 


AVIONICS TEST BED AIRPLANE 

AIRPLANE 
AVIONICS 
DESIGN & TEST 

$3.5 M 

$L8M 
$L 1 M 

$ &4M 

MISSION CONTROL/GSE VAN 

PURCHASED EQUIPMENT 
DESIGN & TEST 

$2.1 M 
$L6M 

$3.7 M 

IRON BIRD (SIL) 

DESIGN 

ACTUATORS, ELECTRONICS 
HYDRAULICS, INSTRUMENTATION 
TEST PROGRAM 

$5.5M 

$2.2M 

$2.35M 

$2.75M 

$12. 8 M 



CONCLUSIONS 


The four multi-technology test beds described will provide the catalyst to break the interdisciplinary 
log-jam that now jeopardizes the success of the "integrated" avionics concept. A coordinated develop- 
ment plan will make these test beds far more effective than if they are undertaken as unrelated uni- 
technology activities. It is essential that the management of these test beds be provided in such a 
way that no single technology faction can lay sole claim to a given facility, even if it geographically 
resides within, and is provided with the major engineering support from, a single technology group. 

On the other hand, it is also important that uni-technology test beds be encouraged to overlap, if 
facility work load requirements make it cost-effective to do so. 

The multi-technology test beds will obviously be exciting activities. If we can get the equipment 
manufacturers and the various elements of the NASA and industry teams to either participate in, or 
witness, demonstrations of the "integrated" approach, we should be able to hold up the electronic end 
of the goals set out for space transportation economy. 



CONCLUSIONS 


so 


• AN INTERWOVEN DEVELOPMENT PLAN (TECHNICAL, COST, 
MANAGEMENT) FOR MULTI TECHNOLOGY TEST REDS SHOULD 
RE MADE FOR SHUTTLE ELECTRONICS TO* 


• OVERCOME SURJECTIVE RARRIER AGAINST SHARED 
USAGE OF EQUIPMENT 


# SHOW HOW SYSTEMS-ORIENTED MANAGEMENT CAN 
SATISFY NEEDS OF DISCRETE TECHNOLOGIES 




a HELP DEFINE THE ORRITER/fcOOSTe 
EQUIPMENT COMMONALITY 



• DEVELOP MISSION CONTROl/GSE ELECTRONIC 
INTERFACES FOR NASA INTEGRATION TASK 
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PRODUCT REQUIREMENTS AND EXPERIENCE - THE 1950's AND 1960’s 


The trend in product reliability requirements from the 1950's through the 1960’s is 
portrayed by the reliability plot from MIL-STD-756A as updated and augmented by experience 
of GE/AESD’s products manufactured in the 1960's. This plot relates system's MTBF to 
system's complexity as experienced by the Navy for airborne Avionics through the early 1960's. 
A series active element is defined as an electron tube or transistor' or ten computer diodes 
or an integrated circuit. 

o Evident from the above plot and chart are trends indicating that during the decade of the 

1960's the reliability requirements and product complexity have, on the average, each in- 
creased by a factor of 10. 

Projecting forward to the requirements and product needs of the technically sophis- 
ticated 1970's, it appears reasonable to expect an extension of this trend, resulting in an 
additional order-of-magnitude rise in reliability technical challenge in the 1970 's. 
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PRODUCT REQUIREMENTS AND EXPERIENCE 
THE 1950’S AND 1960’S 
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WEAPONS SYSTEM FIELD RELIABILITY COMPARISON 


A credibility gap confronting DOD and industry is the disparity between stated equipment 
reliability requirements and realized or realizable achievement. 

A review of the field performance of a 1968/1969 vintage Avionic Weapons System during 
the first three quarters of 1970 illustrates this disparity: 

• Equipment's achieved MTBF vs contractual MTBF differs by as much as 20 to 1. 

• Typical noncompliance is 10 to 1. 

• Only a few select products are compliant. 

This performance for diverse products manufactured by a spectrum of reputable vendors sug- 
gests that management, both government and industry, has lacked a uniform quantitative yard- 
stick with which to dimension, plan, manage, fund, and monitor reliability growth as an in- 
tegral part of product development. 



WEAPONS SYSTEM FIELD RELIABILITY COMPARISON ‘ 


SUBSYSTEM 

MTBF 

GOAL 

FLIGHT MTBF 
(HOURS) 

% MTBF 
ACHIEVEMENT 

JAN- NOV 1970 

JAN- NOV 1970 

LOGIC UNITS 

800 

1812 

226 

TAPE TRANSPORT 

500 

510 

102 

DISPLAY C 

1000 

1396 

140 

INDICATOR 

333 

352 

105 

SEARCH RADAR 

150 

40 

30 

COMPUTER 

1500 

77 

5 

UHF COMMUNICATIONS SET 

1200 

150 

12 

FLIGHT DIR COMPUTER 

1000 

82 

10 

HF COMMUNICATIONS SET 

1200 

70 

5 

INERTIAL NAVIGATION 

750 

42 

5 

DISPLAY A 

1000 

86 

10 

DISPLAY B 

2000 

114 

5 

NAVIGATION-ALTITUDE RADAR 

1000 

51 
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* AIRCRAFT WEAPONS SYSTEM 1968/1969 VINTAGE 


• R PROGRAM PER MIL-STD-785 

• R DEMONSTRATION 
• R ACCEPTANCE 

• FAC I 




A WEAPONS SYSTEM AVIONICS SUPPLIER'S PERFORMANCE 


Insight into the cause and impact of the lack of timely reliability achievement may be 
gained from a review of the time- phased performance of Avionic suppliers on another Avionic 
Weapons System. A number of observations become clear from the following historical data: 

• The original Weapons System reliability apportionments were realistic as 
evidenced by their eventual achievement 

• Timely R&D compliant performance was not achieved 

• Substantial quantities of reliability nonconforming production hardware were 
delivered 

• Modified equipments with their attendant reduced development risks achieved 
compliance in a more orderly and timely fashion than newly developed equipments 

• The initial average achieved reliability was approximately 10% of specified 
requirement 

• Each equipment required extensive test evaluation and improvement before 
achieving compliance 

• Noncompliance applied to all contractors and product types. 

What caused the disparity between the required and the initially achieved reliability? 

The main cause of the credibility gap is that management, both industry and government, was 
readily willing to accept an analytical prediction of performance, derived from adding piece- 
part failure rates, as a projection of expected, initial, product performance. Obviously, such 
a projection is an invalid premise. 

• Reliability growth is an inherent part of the product development cycle. 

• The inability to dimension a framework for this growth is a void in development 
program planning. 



A WEAPONS SYSTEM AVIONICS SUPPLIER'S PERFORMANCE 
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RELIABILITY PLANNING AND MANAGEMENT 


Reliability Planning and Management (RPM) is a new methodology developed by GE/AESD 
to relate reliability criteria to program planning options and constraints. It incorporates 
demonstrated reliability growth rates based on visible evidence of performance, enabling the 
dimensioning of time, resources, assets, and facilities required to bridge the gap between 
the sterile stated reliability requirements and the practical reality of program execution. 

To apply RPM, certain axioms must be accepted: 

1) No design is ready for release to product manufacture until (using MIL- 
Handbook 21 7A failure rates) a reliability prediction (at a minimum) 125% of requirement is 
established. 

2) Based on historical data, initial product performance will be approximately 10% of 
the predicted value. 

3) Reliability growth is predictable and can therefore be planned based on a Reliability 
Growth model. 

Accepting these axioms then, the scope of a reliability growth program can be reduced to one 
simple chart, as shown here, portraying a requirement, a prediction of performance against 
that requirement, a dimensioned initial product performance, and a sized time to compliance. 
This then is the Reliability Planning and Management model as presented by GE to government 
and industry. 



RELIABILITY PLANNING & MANAGEMENT 


• INITIALLY RELEASED DESIGN - APPROXIMATELY 10% OF PREDICTED INHERENT CAPABILITY 

• GROWTH-PLAN PROGRAM BASED ON DUANE GROWTH AND RPM TRADEOFFS 

• PREDICTION - SIMPLIFY DESIGN UNTIL MIL-HDBK-217 PREDICTION IS 125% OF REQUIREMENT 

• SCREENING/ PROCESSING - ADJUST LEVELS TO MEET MTBF REQUIREMENT 


to 

-a 


RELIABILITY GROWTH 



PROGRAM PLANNING OPTIONS 


PROGRAM CONSTRAINTS 


• EQUIPMENTS 

• FACILITIES 

• LEVEL OF CORRECTIVE ACTION 


• CHANGE LIMITATIONS, i. e. , CONFIGURATION CONTROL 

• STATE OF THE ART 

• DOLLARS 

• TIME 



RELIABILITY GROWTH MODEL 


In 1962, J. T. Duane, at the GE Motor and Generator Department, examined the 
performance of electromechanical and hydromechanical products which had undergone many 
thousands of test hours. His efforts resulted in the formulation of a technique for pre- 
dicting the reliability growth of complex equipment. 



RELIABILITY GROWTH MODEL 


• MTBF = a t + b ON LOG -LOG SCALES 

• AXIOMS 

• RELIABILITY IMPROVEMENT OF COMPLEX EQUIPMENT FOLLOWS A 
MATHEMATICALLY PREDICTABLE PATTERN 

• RELIABILITY IMPROVEMENT IS APPROXIMATELY INVERSELY PROPORTIONAL 
TO THE SQUARE ROOT OF CUMULATIVE OPERATING (TEST) TIME 

• FOR A CONSTANT LEVEL OF CORRECTIVE ACTION EFFORT AND IMPLEMENTATION, 
RELIABILITY GROWTH CLOSELY APPROXIMATES A STRAIGHT LINE ON LOG-LOG SCALES 

• THESE RELATIONSHIPS PERMIT USE OF A SIMPLE TECHNIQUE FOR MONITORING 
PROGRESS TOWARD A PREDETERMINED RELIABILITY GOAL 

• DATA SOURCE 

• INITIAL PATTERNS DEVELOPED IN EARLY 1960's FROM DATA ON FIVE DIVERGENT 
GROUPS OF PRODUCTS BASED ON TYPICALLY 50,000 HOURS OPERATING DATA 

2 HYDROMECHANICAL DEVICES, 2 COMPLEX AIRCRAFT GENERATORS, 

1 AIRCRAFT JET ENGINE 

• PATTERN CONFIRMED BY AESD TO BE APPLICABLE TO AVIONICS FROM DATA 
ON 4 PROGRAMS 

• PUBLICATIONS 

• GE TECHNICAL INFORMATION SERIES DF62MD300 BY J.T. DUANE, DC MOTOR 
AND GENERATOR DEPARTMENT 

• 1968 ANNUAL SYMPOSIUM ON RELIABILITY— "RELIABI LITY GROWTH IN 
REAL LIFE" BYE. 0. CODIER, GE/ AESD 



ORIGINAL DUANE DATA 


Duane's findings resulted in the birth of the following concept: 

Reliability improvement for complex equipment is mathematically predictable and 
follows a pattern which is inversely proportional to the square root of the cumulative 
test hours when the equipment is operating in its intended use environment. 

For a constant level of effort toward, and timely implementation of, corrective 
action, reliability growth closely approximates a straight line on log- log scales. 

Note that the slope (or) ranges from 0.35 to 0.5. Growth limits are estimated to 
have a maximum rate of approximately 0.5. A rate of 0. 1 can be expected on programs 
where no concentrated effort is directed toward reliability improvement but where action 
is taken only in response to major field problems or customer complaints. This is the 
key to sizing the scope of the test evaluation program necessary to effect compliance. 

Our higher order RPM model incorporating the ability to dimension initial reliability per- 
formance was born out of this original work by Duane and out of studies at AESD aimed 
at deriving a meaningful development model. 



CUMULATIVE MTBF (HOURS) 


ORIGINAL DUANE DATA 





RPM MODEL PROGRAM 1 


The first AESD program examined was Rapid Tune, a 2000 piece-part Automatic Fre- 
quency Control for a Fire Control Radar System . All aspects of this program showed ex- 
cellent correlation with the Reliability Growth Model and provided initial insight leading to 
this higher order RPM model. The new equipment initially performed at approximately 10% 
of the predicted MTBF and achieved a reliability growth rate (ot) of 0.48, taking 10,000 
hours of evaluation test to grow the as- released configuration to one that was conforming. 
The reliability growth rate did not persist for the additional 10, 000 hours of Acceptance 
Test during the production program under change control constraints. 



MTBF (HOURS) 


RPM MODEL 


PROGRAM 1 VINTAGE 1961 - 1965 




RPM MODEL PROGRAM 2 


A second correlation of the Reliability Growth concept was a midprogram study of the 
AN/APQ-113, a 1965 vintage radar for the F-lll Program and 5 times more complex a product 
than Rapid Tune* Excellent. model correlation was shown. Initial performance with the 16,000 
part configuration was 9 hour,s versus a 90 hour MTBF prediction, but well shy of the 137 hour 
minimum requirement. A redesign reduced parts count to 10, 000, which with concurrent in- 
corporation of extended parts and product screening resulted in initial performance of 18 hours 
versus a 180 hour prediction. Reliability growth rate (Of) was 0. 5 with change introduction 
flexibility, and much lower under production change control constraints. 



MTBF (HOURS) 


RPM MODEL 

PROGRAM 2 




RPM MODEL PROGRAM 3 


The RPM model, postulated post facto for the Rapid Tune and AN/APQ-113 programs, 
was applied in forward fit for the first time by AESD at the inception of the AN/APQ-114 
program, a 20 % design- modified version of the AN/APQ-113 radar- 

A composite model based on projected performance of changed and unchanged hardware 
forecast an initial performance of 33 hours MTBF. A conservative realiability growth slope ( Of ) 
of 0-375 was projected, and a 3750 hour test program was structured, negotiated, and con- 
ducted. Correlation between performance and projection was excellent. The 21 systems 
which were subjected to Reliability Acceptance Testing measured 212 hours MTBF, making 
all hardware delivered on the program compliant with reliability requirements. 
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RELIABILITY GROWTH-PREDICTED vs EXPERIENCED 
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PLANNING EXAMPLE 


RFQ Requirement 

• New equipment - within state of art 

• R & D target time - 36 months 

• MTBF 150 hours - Weapons System apportioned 

• R program per MIL- STD- 785 

• Test per MIL-STD-781 level F 

• FACI and configuration control - 1st production item 


Initial Contractor Plan 

• Complexity 

• Estimate - 11K electrical piece parts, 220 hour prediction 

• High Reliability Program _ 

• Design disciplines, R parts, screening, evaluation testing 

• Time Phase Plan 

• 15 month design, 6 month manufacturing, 12 month evaluation, 

3 month production transition 

• Implementation Options 

• Minimum assets 

- 1 equipment, spares, 24 month evaluation 

• Compliant time 

- 2 equipments, spares, 12 month evaluation 

• Least risk 

- 3 equipments, spares, 8 month evaluation 

- Growth contingency 25 c o, 12 month evaluation 



PLANNING EXAMPLE 


OPTIMIZATIONS: 

MINIMUM ASSETS - VARY Tl ME COMPLIANT SCHEDULE 
COMPLIANT TIME - ADEQUATE ASSETS 




RPM APPLIED TO SPACE SHUTTLE 

( MTBF = at + b) 

• BEWARE OF NEW EQUIPMENT DESIGNS (b) 

where reliability will be approximately 10% of prediction 

• ADDRESS TIME CONSTRAINTS (tl 

through accelerated testing (step stress, overkill) 

• ACCELERATE RELIABILITY GROWTH (a) 

through aggressive problem identification, corrective action, 
and test validation 

• ASSURE THAT SUBSTANTIVE RELIABILITY PREDICTIONS EXCEED REQUIREMENTS (MTBF) 

by sufficient margin to enhance achievability and allow 
for uncertainties 

• OPTIMIZE LEVEL OF SCREENING TESTS (MTBF) 


commensurate with reliability requirements 



A REALISTIC APPROACH 


TO A 

COST EFFECTIVE DESIGN AND TEST PROGRAM 
FOR 

FUTURE SPACECRAFT EQUIPMENT 


Gilbert Friedenreich 

Section Chief Reliability ft Maintainability 
and 

Howard Wright 

Assistant Director Space Shuttle Program 
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ABSTRACT 


This paper will present the results of an analysis to develop specific cost effective guidelines for the design, 
test and maintenance of reusable spacecraft hardware. The analysis is based on a study of hardware performance 
and reliability that is thoroughly documented in the Apollo Lunar Module Program. 

The paper will cover all phases of equipment testing and utilization. The paper concludes that major program expendi- 
tures in the past were avoidable - and that early implementation of an effective program, augumented by a rigorous 
management discipline, can prevent unnecessary cost in the future. 



OBJECTIVE 


ANALYSIS OF HISTORICAL DATA TO STRUCTURE 
A COST EFFECTIVE TEST PROGRAM 

• SPACE - APOLLO - OAO 


• AIRCRAFT - MILITARY 



IMPACT OF ENVIRONMENT OVER PROGRAM LIFE 


Failure Due to Environment Causes 
Decrease as Total System Matures 

— Changes Due to Special Efforts - 
Corrective Action Teams 

— Incorporation of ECP's - Based on Field Results 

— Special Test Efforts 

Elimination of These Problems Should Be Accomplished 
by Means of Early & Effective Test Programs 

— Verification 

— Acceptance 



IMPACT OF ENVIRONMENT OVER 
PROGRAM LIFE 




TEST PHASES 


All Programs are Logically Divided Into Test Phases 

• Group I (Dev, Qual, & Demo) - To Verify Design Integrity 

• Group II (Acceptance) - To Confirm Quality 

Basic Design Must Be Environmentally Sound & Confirmed 
Thru Development, Qual, & Finally Reliability Demonstration 
Test 

Group II — The Workmanship, Q/C, & MFG Defect Type of Problem 
Must Be Eliminated (Burn-In). Also, The Reliability 
Originally Designed & Proven in I Above, Must Not Be 
Allowed To Degrade in Production. Failure-Free Environmental 
Tests Accomplish This. 


Group I — 


<01 

02 



TEST PHASES 


• DEVELOPMENT ) VERIFY 

• QUALIFICATION j DESIGN GROUP I 

• RELIABILITY DEMONSTRATION ) INTEGRITY 


• RELIABILITY ACCEPTANCE l 

- CONTROL QUALITY OF PRODUCT 

- WORKMANSHIP PROBLEMS I 

- PROCESS CONTROL ! 

- MATERIAL DEFECTS 


product group „ 

CONTROL 



DESIGN VERIFICATION TESTING DURING DEVELOPMENT 


Comparison of Design Failure Distribution 

Similar End Results - Equal Failures in Vehicle Level Tests - 
But With Strong DVT Much More Efficient 

- Limited DVT 

• Majority of Design Failures in Qual & Accept 

• Big Impact on Cost & Schedule 

— Strong DVT 

• Majority of Design Failures in DVT 

• Minimal Impact on Cost & Schedule 



DESIGN VERIFICATION TESTING DURING 
DEVELOPMENT 

TYPICAL SPACE PROGRAM (1968) 

■ DESIGN □ QUALITY 
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UNIT 
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• LIMITED DVT • STRONG DVT 



STEP STRESS TEST EFFECTIVENESS 


• Field Data Comparison for Three Equip. 

Subjected to Step Stress Tests 

• Time Periods Covered Six Months & Total 
Operating Times (Prior to & After C/A)Approx Equal 


• Appreciable Savings Realized for These Equipments 
Even When: 

— Limited Time Period Considered 

— Conservative Failure Cost Utilized 


TYPICAL AIRCRAFT PROGRAM 
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% SAVINGS 
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TOTAL FIELD FAILURE DISTRIBUTION 



RELIABILITY DEMONSTRATION 


CT> 

to 


• COSTLY & LENGTHY 

• INEFFICIENT FOR REVEALING DESIGN PROBLEMS 

BUT 

• PROVIDES CONFIDENCE IN EQUIP. RELIABILITY 

• ASSESSES TIME - DEPENDENT PROBLEMS 

• EXTREMELY EFFECTIVE IN CONTROLLING 

EQUIPMENT RELIABILITY 



RELIABILITY DEMONSTRATION - 
TYPICAL TEST PLAN 


TOTAL NO. 
OF FAILURES 



TOTAL TEST TIME (IN MULTIPLES OF SPEC MTBF) 



A-D CONVERTER TEST & FIELD RESULTS 


Burn-In Flu* Reliability Acceptance Tests Must Be Applied to 
Each Item for Effective Control 

The A-D Converter Was Subjected to 50 — 100 Hrs of Total 
Test Time which Served to: 

— Burmin Equipment 

— Force Subcontractor to Accomplish 25 Hours of Failure-Free 
Operation (Implicit in This, is the Fact That Proper Remedial 
Action Be Taken to Permit Completion of Failure-Free Tests) 

Although Obviously Effective, Failures Still Evident After 600 
Hrs & Failure Rate is Still Not Constant 

Investigation Revealed Time- Dependent Failures 

At Present, an In-House Study is Being Undertaken to Establish 
More Effective Methods of Detecting Latent Defects 



A-D CONVERTER TEST & FIELD RESULTS 


AT MANUFACTURERS FIELD 
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HOURS (OPERATING) 


• DENOTES FAILURE 



BURN IN EFFECTIVENESS FOR PRIMARY 
TAPE DIAL INDICATORS 


Burn-In Tests Required to Eliminate Workmanship 
& Q/C Problems 

Environmental Exposure Mandatory 
Duration 

— Function of Equipment Type 

- Initial Data Used to Establish Time to Constant 
Failure Rate. Subsequent Test Times Dependent 
on Initial Test Results. 

Data, Plus Experience, Indicates that Avionic Equipment 
Requires Longer Burn-in to Achieve Constant Failure 
Rate than Non-Avionics Equipment 



BURN-IN EFFECTIVENESS FOR PRIMARY 
TAPE DIAL INDICATORS 
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VHF TRANSCEIVER 


• Cost Drivers 

— Higher Level Parts 
- Increased Redundancy 
— More Intensive Testing 
— More Stringent Mission Requirements 
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VHF TRANSCEIVER 

TYPICAL SUBSYSTEM COMPONENT COSTS vs MTTF 


COST, 

$1000 



10 20 30 40 50 


MTTF, MONTHS 



CONCLUSIONS 

RECOMMENDED APPROACH 

• STRONG EARLY DEVELOPMENT 
TEST PROGRAM 

- DESIGN VERIFICATION TEST 

- STEP STRESS TEST 

• EFFECTIVE QUALIFICATION PROGRAM 

- CORRECT SIMULATION 

- STRONG MANAGEMENT CONTROL 

• SELECTIVE RELIABILITY 
DEMONSTRATION TESTS 

- COMPLEX LOW MTBF SYSTEMS 

• 100% ENVIRONMENT ACCEPTANCE 

- BURN-IN 

- FAILURE- FREE 



GUIDANCE, NAVIGATION, AND CONTROL 
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SHUTTLE ASCENT GUIDANCE AND CONTROL REQUIREMENTS 

J. C. Blair and J. A. Lovingood 

NASA-Marshall Space Flight Center 
Huntsville, Alabama 



SHUTTLE LAUNCH VEHICLE CHARACTERISTICS AFFECTING ASCENT GUIDANCE AND CONTROL 


In the combined boos ter/orbi ter ascent configuration, the space shuttle is a launch vehicle which 
has a number of characteristics unlike previous launch vehicles. These new characteristics necessitate 
an examination of the shuttle ascent guidance and control philosophy to insure that stringent requirements 
will be met. The slide lists some of these characteristics which may force a departure from conventional 
launch vehicle guidance and control practice. Selected characteristics will be discussed in more detail, 
and their impact on ascent guidance and control requirements will be summarized. 



SHUTTLE LAUNCH VEHICLE CHARACTERISTICS 
AFFECTING ASCENT GUIDANCE Q CONTROL 


CONFIGURATION DESIGNED FOR REUSE 
HIGH PITCH STABILITY 
HIGH YAW-ROLL COUPLING 
PITCH - YAW ASYMMETRY 
INTACT ABORT 
MISSION MODEL 

HIGH USE RATE, SHORT TURNAROUND TIME 
WIDE RANGE OF MISSIONS 


SMALL PAYLOAD FRACTION 

MULTIPLE CONTROL VARIABLES 

BENDING CHARACTERISTICS 
COMPLEXITY 
LACK OF FULL- SCALE 
TESTING 

LONGITUDINAL ACCELERATION 
CONSTRAINT 

BOOSTER FLYBACK 

SIDE-BY-SIDE STAGE MATING 



COMBINED INTERACTION AND OPTIMIZATION 


For the shuttle, more than for previous launch vehicles, there are both a need and an opportunity 
for combined optimization of the guidance and control systems along with the free configuration parameters 
which are related to flight mechanics. The smaller payload fraction of the shuttle makes the benefits 
of optimi zation more significant. The sensitivity of the payload to positioning of the total force 
vector during ascent, coupled with a relatively low control authority, implies a significant guidance/control 
interaction. At this time point in the shuttle development, adequate analytical and computational methods 
can be used to determine the best overall systems in time to influence configuration design as well as 
guidance and control. 



COMBINED INTERACTION AND OPTIMIZATION 





ASCENT TRAJECTORIES 


The fact that the shuttle vehicle is designed for flight phases other than launch and the strong 
need for maximizing the payload imply that the conventional gravity turn trajectory during atmospheric 
flight may not be a valid philosophy for the shuttle. The total ascent trajectory should be optimized, 
taking into account constrai nts on booster flyback and loading effects on structural weight. The time 
histories shown on this chart illustrate the differences between a trimmed gravity turn and a maximum 
payload trajectory optimized without structural or flyback considerations. Depending upon the 
configuration, optimal shaping can provide a significant gross increase in injected payload. The 
effect of structural and flyback considerations remains to be determined. 
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CTOR/ES 


GRAVITY TURK 


UNCONSTRAINEI 



FLIGHT TIME (sec) 





EFFECT OF ATMOSPHERE ON TRAJECTORY OPTIMIZATION 


The guidance system used for shuttle ascent (either open-loop tilt command or closed-loop guidance) 
must consider aerodynamics in its formulation. The payload effect of not including aerodynamics is 
shown in this graph. Injected weight is plotted versus time of initiation of the optimization for two 
trajectory optimization programs - one which includes aerodynamics in its formulation and one which does 
not (vacuum flight equations). The vacuum flight formulation results in a sharp payload loss when it 
is used near the maximum q region or earlier. 

The guidance loop will be closed at some point during ascent in order to reduce dispersions and 
o meet the end conditions. It appears likely that guidance or a path feedback loop will need to be closed 

early enough that aerodynamic forces will be a significant influence on the closed-loop system. 



INJECTED WT ( lbs ) 


EFFECT OF ATMOSPHERE ON TRAJECTORY OPTIMIZATION 




TYPICAL AERODYNAMIC CHARACTERISTICS 


Aerodynamic characteristics for a shuttle vehicle are shown on the chart. Typically, these vehicles 
have been neutrally stable in yaw and highly stable in pitch during the maximum dynamic pressure region 
as shown by the curves on the left. The curves on the right show the roll moment coefficient per degree 
sideslip angle C ] g and the roll moment per degree elevon deflection C]g a normalized to the max q flight 
condition. The surface effectiveness for generating roll peaks prior to Mach 1 and then has a very rapid 
decline so that at the crucial max q flight time, the effectiveness is less than one-half of its maximum 
value. This, of course, means that larger deflections are required at q max than at, say, Mach 1; but, 
perhaps more significant is the uncertainty in the value of the effectiveness from Mach 1 to max q 
because of the rapid change. Uncooperati vely , manages to increase and hold fairly steady through the 
Mach 1 to max q region. 



PERCENT REFERENCE LENGTH (AFT OF NOSE) 


TYPICAL AERODYNAMIC CHARACTERISTICS 





PITCH GIMBAL ANGLE RESPONSE TO WIND 


The high stability in pitch causes large gimbal requirements in order to maintain satisfactory path 
performance in the presence of winds. The gimbal requirement is increased further by the center of mass 
of the composite vehicle being off the geometric centerline and the aerodynamic lift for optimum performance 
being nonzero. For vacuum flight, the off-centerline center-of-mass would require the thrust vector to 
deflect so that the thrust would be directed through the mass center. However, because of the nonzero 
aerodynamic lift force required for optimum performance, the engine thrust must be deflected in a manner 
to counter the aerodynamic moment induced by this lift. The chart indicates the amount of engine gimbal ing 
required for a modified gravity tilt point mass trajectory. The modifications were made to increase 
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performance without causing excessive structural loading. 

The effect of headwinds and tailwinds on gimbal angle is also shown in the chart. One can readily 
see that this particular configuration requires at least 10° gimbal angle because important factors such 
as an engine thrust failure, bending and slosh stabilization requirements plus uncertainties in the airframe 
dynamics have been omitted. 

Path angle and integral of path angle feedback, along with the usual attitude and attitude rate feedbacks, 
were required in order to get the engines off the 10-degree stops for the 3 km altitude wind which was simulated, 
in addition to the path angle feedbacks reducing the gimbal angle, a gain of 4,000 lbs payload was realized by 
their addition. This points out the very strong requirement that we can expect for some type of relatively high 
gain guidance during ascent - perhaps even a terminal guidance mode being initiated prior to max q. 



PITCH GIMBAL ANGLE RESPONSE TO WIND 


3 km GUST ALTITUDE 

PATH ANGLE AND / PATH ANGLE 



EFFECT OF AERO SURFACE FOR ROLL CONTROL 


This chart demonstrates the efficacy of differentially-deflected elevons in reducing roll excursions. 
The engines are deflected to their stops in the pitch plane as shown by the 6p^ and 6p^ traces. A roll 
angle qj of 20° and roll rate of 8.9 degrees/second are experienced, and sideslip B is held to less than 4°. 
The yaw gimbal angle 6y stays at reasonable values. (Differential gimbaling in yaw is not employed.) The 
lower figure shows a dramatic reduction in these parameters. Because of the high surface effectiveness, 
very small elevon deflections 6^ occur. 

Besides the effectiveness uncertainty being a problem, large surface deflections will introduce drag 
losses, and if it becomes necessary to increase the deflections to the extent that entry hinge moments 
are exceeded, the actuator hydraulic system requirements would increase. Consequently, the control system 
should mix the thrust vector and aero surface controls so that an "optimum" trade-off is obtained. The 
trade-off should not be limited to only the roll problem; in addition, the use of surfaces for trimming 
the aerodynamic moments in pitch, as well as possible rudder control in yaw, should all be considered to 
determine the best overall design from a performance, structures, and guidance and control viewpoint. 



EFFECT OF AERO SURFACE 
FOR ROLL CONTROL 

95% YAW WIND ENGINE OUT AT 58 SEC 



POSSIBLE CONTROL SYSTEM SOLUTIONS 


Preprogrammed attitude or angle of attack commands would sufficiently define the flight environment 
during ascent that time-programmed gains could be employed. However, trajectory sensitivities to winds 
and aerodynamic uncertainties might preclude such a procedure. Also, an uncertain variation of gain 
requirements as a function of flight time might occur because of abort contingency requirements. 

Consequently, air data sensors and gain scheduling as a function of dynamic pressure and Mach number might 
give better overall performance of the flight control system. 

So far in the shuttle program, ascent loads have not really been a driver as far as the control system 

requirements are concerned. However, we are cetain to face the requirements for load relief feedbacks such 

oo as normal accelerations and angle of attack as the shuttle program progresses; structural bending loads will 
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certainly require load alleviation schemes of presently unknown sophistication. In pitch, some form of path 
feedback will be required, unless a closed loop terminal guidance scheme is employed. Alleviation of the 
yaw-roll coupling problem could be obtained by adjusting a sideslip feedback gain as a function of roll rates 
or attitudes. The adjustment would be made so that whenever high winds are encountered and excessive roll 
occurs, the yaw control channel would have increased sideslip feedback so that roll accelerations due to 
sideslip would be reduced. The sideslip gain would be decreased to some nominal, probably nonzero, value 
when the roll transients have been adequately damped. 

Some control authority must be available for bending stabilization. Since several configurations studied 
during Phase B have exhibited dynamic characteristics which cause gimbal angles near the 10° mechanical limit, 
a suggestion has been made to electronically limit the attitude error command so that some reserve is always 
maintained for bending stabilization. 



POSSIBLE CONTROL SYSTEM SOLUTIONS 


PITCH , ROLL AND YAW 

PREPROGRAMED ATTITUDE AND/OR ANGLE OF ATTACK 
COMMAND WITH TIME PROGRAMED GAINS (NOMINALLY 
ATTITUDE AND ATTITUDE RATE, ANGLE OF ATTACK) 

SCHEDULING OF CONTROL GAINS AS A FUNCTION OF 
DYNAMIC PRESSURE AND MACH NUMBER (FOR USE WITH 
ITERATIVE GUIDANCE AND FOR ABORT REQUIREMENTS) 

PITCH 

PATH FEEDBACKS - PATH ANGLE, NORMAL VELOCITY 
LOAD RELIEF FEEDBACKS - NORMAL ACCELERATIONS, 

ANGLE OF ATTACK 


YAW - ROLL 

SIDESLIP GAIN PROPORTIONAL TO ROLL RATE OR ATTITUDE 

PREPROGRAM OR GUIDANCE INITIATE ROLL MANEUVER 
BASED ON CROSS WINDS 

ELECTRICAL LIMIT OF YAW ATTITUDE FEEDBACK TO 
ALLOW RATE COMMAND FOR BENDING STABILIZATION 
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STRUCTURAL BENDING CONSIDERATIONS 


Structural bending modes are even more critical than on previous launch vehicles. The control system 
requirements at the present time are not determined because the structural models are not sufficiently well 
defined to permit a complete evaluation. However, initial models of the structure indicate that bending 
mode frequencies will be sufficiently separated from rigid body modes that conventional concepts of gain 
and phase stabilization can be employed. A departure from convention may be necessary because of the uncertainty 
of the structural data. 

There will be no full scale vertical vibration testing of the launch configuration as we had for the 
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►-» Saturn and other programs. The main reason is cost. While mathematical modeling has improved significantly 

in recent years through finite element analysis techniques, the complex shuttle configuration presents new 
vibration problems. The piggy back arrangement of the orbiter and booster will cause aerodynamic interaction 
with the structural modes of two coupled bodies to an unknown extent. Wing bending during ascent must be 
considered and possibly even special procedures employed to damp wing bending modes. The use of aerodynamic 
surfaces on the wings for control during ascent will increase the coupling of these modes with the rigid body 
motion of the vehicle. The effect of torsion and bending at the booster/orbi ter tie points will have to be 
carefully considered. Mathematical models of the structure may not adequately define the crucial bending 
data such as frequencies and mode shapes, and particularly, structural damping is available only from full 
scale testing. Verification of the math models will be obtained by scale model testing. However, while the 



scale model results will certainly improve our confidence in the bending data, it will still leave a lot 
to be desired since to get accurate data requires an accurate model which again becomes prohibitive in cost. 
Component testing will also be employed but vibration data defined from such tests will still require 
mathematical techniques for joining the components. 

The upshot of this is that sophisticated bending stabilization schemes may be required. The experience 
of aerospace research control engineers in the development of such schemes is legend. The last decade or 
so has seen the development of many adaptive bending stabilization concepts. One such system developed 
for and applied to the Saturn/Apollo is the Spectral Identification Adaptive Control Scheme shown on the 
chart. The concept involves a digital correlation of the outputs of the airframe to identify the frequencies 
of the elastic modes. Decoupling of these modes from the rigid body response is achieved by the use of notch 
filters. Results obtained with this sytem were very good; first mode frequency variations Of 25% were handled, 
and much larger variations on the higher modes could be tolerated. Also, computer speed and storage 
requirements are reasonable. The identification concept can be used with other stabilization concepts; 
particularly, shaping filters could be employed to provide proper phasing to the control commands to stabilize 
the inodes. This and other possible schemes should be examined in depth to determine first, what degree of 
sophistication in bending stabilization is required for the shuttle and second, what can be practically 
and reliably implemented. 

















MISSION MODEL EFFECTS 


The mission model contains a variety of target orbits to be achieved by the shuttle, ranging in 
inclination from easterly launch to sun-synchronous and beyond, with a number of altitudes. Frequent 
launches are expected, and there exists the possibility of quick-response launches such as for rescue 
or DOD missions. These conditions dictate that the prelaunch guidance calculations be kept to a 
minimum. A self-targeting guidance system which can accept end condition changes in real time can 
provide the required flexibility and autonomy to meet these conditions. Also, approximations in the 
guidance formulation which require specially-computed tuning inputs should be avoided. 
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CJ1 


MISS/ON MODEL 

VARIETY OF TARGET ORBITS 
HIGH TRAFFIC DENSITY 
QUICK RESPONSE 

♦ 


NO EXTENSIVE PRELAUNCH 


SELF - TARGETING GUIDANCE 
FEW SPECIAL - TUNING INPUTS 
TO GUIDANCE SYSTEM 



INTACT ABORT 


Intact abort places a strong requirement on the guidance and control system for flexibility 
(adaptability to change). An example of the diversity of flight conditions possible in an abort 
situation is illustrated in this slide. Altitude and velocity time histories are shown for a 
nominal ascent and for an abort-to-once-around mission which assumes one orbiter engine out at 
ignition. 

The variety of trajectory and flight conditions possible for abort dictates a guidance system with 
«j> onboard retargeting capability and a control system with gains scheduled by either air data or adaptive 

loops. 



INTACT ABORT 
ABORT TO ONCE - AROUND 

NOMINAL INJECTION 

ONE ORBITER ENGINE OUT AT IGNITION 




BOOSTER FLYBACK CONSTRAINT 

This slide is an example plot of the weight of booster flyback fuel required for a variety of 

staging conditions. A function similar to this must be included in the trajectory generator as part 

of the performance index in the design phase, or as a constraint for the post-design phase. Notice 

that the functions are nearly linear, which may facilitate their inclusion into a trajectory 

generator or guidance scheme, 
co 
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SHUTTLE ASCENT GUIDANCE AND CONTROL REQUIREMENTS 


The characteristics of the launch-configuration shuttle may be translated into requirements on the 
ascent guidance and control systems which are summarized in this chart. The list is not intended to 
be a comprehensive description of the system requirements, but includes many of the more significant 
or unconventional features which result. Some items listed are firm requirements under the current 
shuttle groundrules; others are possibilities or al ternati ves. 

While most of the items have been previously discussed in the presentation, two of those listed 
under "hardware" need further comment. It seems likely that the guidance system requirements described 
herein can be met with a digital computer of reasonable speed and storage. Floating point arithmetic 
would be very desirable, considering the wide spectrum of conditions to be accommodated and the need 
to minimize prelaunch verification computations. In the control hardware requirements, the use of 
a digital rather than analog controller would permit the various control methods we have discussed 
(gain scheduling, bending accommodation, etc.) to be met without undue hardware complication. 



SHUTTLE ASCENT GUIDANCE AND CONTROL REQUIREMENTS 

ANALYSIS 

GUIDANCE ~ CONTROL 

OPTIMIZE ATMOSPHERIC TRAJECTORY MULTIPLE - CONTROLLER SYNTHESIS 

DEMONSTRATE PERFORMANCE FOR WIDE ANALYSIS FOR BROAD SPECTRUM 

RANGE OF TARGETING CONDITIONS OF FLIGHT CONDITIONS 

DISSIMILAR PITCH AND YAW PLANE ANALYSES 
OPTIMIZATION OF GUIDANCE, CONTROL, CONFIGURATION 


SOFTWARE 

GUIDANCE 

ATMOSPHERIC CLOSED-LOOP GUIDANCE OR 

FLYBACK, STRUCTURAL CONSTRAINTS 
REAL-TIME CHANGE OF END CONDITIONS 
GENERAL (NOT APPROXIMATE) FORMULATION 

ACCOMMODATION OF WIND 


CONTROL 

PATH FEEDBACK 
LOAD RELIEF 
ADAPTIVE ALGORITHMS 

BIASING 


HARDWARE 


GUIDANCE 

DIGITAL COMPUTER REQUIREMENTS 

SPEED 

STORAGE 

FLOATING POINT ARITHMETIC 


CONTROL 

SENSORS-Q BALL, NORMAL ACCELERATIONS 
MULTIPLE - RATE GYROS 

AIR DATA : q, q - ALPHA, MACH 
DIGITAL CONTROLLER 
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KEY ISSUES FOR SPACE SHUTTLE ASCENT GUIDANCE 


J. G. Rupert 

HONEYWELL INC. 
St. Paul, Minnesota 


FOREWORD 

This paper presents trajectory analysis results for several NAR/GD vehicle config- 
urations investigated during our Phase B Shuttle Program. Structural weight data and 
booster flyback propellant requirements needed to perform this study were provided 
by J. Joanides, R. Gatto and R. Wilson at NR and by G. Krus, W. Pense, and R. 
Bithell at GD. Special acknowledgement is due to D. Engels at NR and A. Nelson at 
GD who made our effort meaningful through coordination with related studies at NR 
and GD. R. K. Phelps at Honeywell was primarily responsible for the direction of 
this, effort at Honeywell. 



INTRODUCTION 


We have been studying the design of the first stage trajectory since the begin- 
ning of the Phase B Shuttle Program. Our motivation in this effort has been to 
determine the sensitivites of important variables affecting payload in order to 
design a guidance policy. 

Primary factors influencing trajectory design include ascent fuel, structural 
weight requirements, booster flyback propellant requirements and the on-orbit 
propellant needed for an orbiter abort with an engine failure at staging. Each of 
these variables depends strongly on the attack angle and throttling policy during 
the mated ascent. The flyback propellant requirement and the abort require- 
ment pose some new problems for trajectory optimization which are unique to the 
Shuttle. 

Finally, sensitivity of the booster flyback propellant to the staging state makes 
it advantageous to consider this constraint in the closed loop first stage guidance 
law. 



IMPORTANT VARIABLES IN ASCENT 
GUIDANCE AND CONTROL 


• ASCENT FUEL 

• STRUCTURAL WEIGHT 

• BOOSTER FLYBACK PROPELLANT 

• ABORT 


• DISPERSION PENALTIES 



106 


ORBITER STRUCTURAL WEIGHT REQUIREMENTS 
FAVOR POSITIVE ATTACK ANGLES 


Slide 2 shows the dependence of orbiter structural weight on the attack angle 
at maximum dynamic pressure. To prepare this plot, the amount of load carrying 
structure required by flight conditions other than max q (e.g. ; entry, landing, mini- 
mum gauge, etc.) was first computed. The additional orbiter structural weight 
required was then computed as a function of the q-y loading at max q. Most of the 
additional structural weight required results from wing loading and skew to the 
curve is caused primarily by the negative wing incidence angle on the delta wing 
orbiter. 

Both trajectory shaping and load relief influence the structural weight require- 
ments. Because weight requirement depends asymmetrically on attack angle, trajec- 
tory shaping is used to bias the swing in qcy loads obtained with headwinds and tail- 
winds in positive direction. Load relief is used to reduce the magnitude of the q<* 
swing. The optimum trade off between fuel and structural weight requirements is 
obtained through an iterative process between trajectory shaping and load relief. 
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ORBITER T ORBITER STRUCTURAL WEIGHT VERSUS q« AT MAX q 

Aorbiter structural 



qa(PSF-DEGREES) 


SLIDE 2 



LOAD RELIEF STUDIES ON LIFTING TRAJECTORIES 
SHOW REDUCED STRUCTURAL WEIGHT REQUIREMENTS 


The qa loads resulting from winds were compared for a lifting trajectory and the 
gravity turn. In the control system design, the degree of load relief was varied by 
changing the controller attitude gain during the high q region. Results obtained with 
K q = 1 (No Load Relief) and K = . 1 (With Load Relief) are illustrated in Slides 3 

u u 

through 8. There are several major differences between lifting trajectories and 

the gravity turn depicted in these results. 

First, Slides 3 and 4 illustrate the relative influence of trajectory shaping and 

load relief in reducing structural weight requirements. For both trajectories, the 

magnitude of the qa swing was significantly reduced with load relief. However, the 

© positive bias given to the qey swings by the use of the lifting trajectory was a major 
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contributing factor to the weight saving obtained. Using load relief and trajectory 

shaping, a net saving, in this case, of 4, 000 lbs was realized. 
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I Ml 
SEC 


TAIL WIND WITH 
LOAD RELIEF 


SLIDE 3 
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LOAD RELIEF CAN PAY OFF 


Slide 4 shows the time history of qo- with and without load relief for 1 a zero alpha 
lifting trajectory. The use of Load relief reduced the qa tailwind load from -3000 psf 

to -1600 psf, which resulted in a structural weight saving of approximately 1800 lbs. 

By comparison, the fuel penalty (for the headwind condition) was increased by less 
than 100 lbs. 


Qa LOADING FOR ZERO ALPHA TRAJECTORY 



SLIDE 4 
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LIFTING TRAJECTORIES RESULT L\ T HIGHER DYNAMIC PRESSURES 


Another difference between lifting trajectories and the gravity turn is depicted 
3<i Slides 5 and 6. The lifting trajectory has a substantially higher maximum dynamic 
pressure than is obtained with the gravity turn (850 psf vs. 730 psf with the headwind). 
This result stems from the fact that lifting trajectories have lower curvature and fly 
lower through the atmosphere initially than the gravity turn. 


DYNAMIC PRESSURE FOR GRAVITY TURN 


DYNAMIC 

PRESSURE 

(PSF) 



SLIDE 5 
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DYNAMIC PRESSURE FOR LIFTING TRAJECTORY 


Slide 6 shows the time history of dynamic pressure for a zero alpha lifting 
trajectory. The dynamic pressure for the headwind condition is higher than for the 
gravity turn pressures illustrated in Figure 5. Structural weight criteria given in 
Slide 2 were altered slightly (~ 200 lbs) as a result of the higher pressure. 

DYNAMIC PRESSURE FOR ZERO ALPHA TRAJECTORY 



SLIDE 6 



TRAJECTORY SHAPING INFLUENCES GIMBAL ANGLE REQUIREMENTS 


Slides 7 and 8 show that the lifting trajectory reduced the gimbal angles. 

This results from the positive bias to the qa swings and the vehicle's aerodynamic 
stability. However, this was not a general result, since on some of the vehicles 
we investigated, the aerodynamic moment at zero angle of^ attack was sufficiently 
large at max q to cause the gimbal angle to be less than its value at lift-off which 
resulted in an increased gimbal angle requirement. 



TIME (SEC) 



GIMBAL ANGLES FOR LIFTING TRAJECTORY 


Slide 8 shows the time history of the gimbal angle (referenced to the x body axis). 
On some vehicle configurations and larger attack angles the gimbal angle actually 
would go negative. 
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GIMBAL ANGLE FOR ZERO ALPHA TRAJECTORY 
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FLIGHT CONDITIONS DURING MATED ASCENT 


AFFECT STRUCTURAL WEIGHT REQUIREMENTS 


Slide 9 shows the variation of booster peak limit ultimate load intensity with body 
station for several flight conditions. The highest load intensities, which determine 
shell thickness and structural weight, are seen to occur at three conditions: max 
dynamic pressure occurring approximately seventy seconds after lift-off, entry to 
the g constrained arc approximately 160 secs after lift-off, and at staging. 

Slide 9 shows that roughly fifty percent of the booster structure is designed by 
conditions on the acceleration constrained arc. Reducing the g limit reduces booster 
structural requirements but results in increased fuel and flyback propellant require- 
ments. 



AXIAL 




Slide 10 illustrates how the acceleration limit affects fuel and structural weight 
requirements. The &Wts shown are referenced to the baseline 3g limit. Weight 
changes indicated in the figure are: 

1) Booster Structural Weight 

2) Orbiter Structural Weight 

3) Orbiter Ascent Fuel Corrected for Flyback Propellant 
Variations (See Slides 11 and 12) 

4) The change in payload trading orbiter structure and fuel 
with payload on a 1-1 basis and booster structure with 
payload on a 6-1 basis 

In this study, the g limit and q<* weight trades were conducted independently. 
Close examination of the load intensity plots in Slide 9 indicates that they should 
be conducted in parallel. 
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EFFECT OF g LIMIT ON PAYLOAD 



" A WTS REFERENCED TO 3g BASELINE 


SLIDE 10 



BOOSTER FLYBACK PROPELLANT REQUIREMENTS INFLUENCE 
TRAJECTORY OPTIMIZATION 


The requirement that the booster fly back to the launch site has a significant effect 
on trajectory optimization. Flyback propellant requirements, WPFB, increase 
sharply with staging altitude and flight path angle as illustrated in Slides 11 and 12. 
Trajectory design was carried out, letting the staging condition and the flyback propel- 
lant be variables and seeking the optimum injected mass by trading flyback propellant 
and orbiter injected gross weight. Orbiter injected gross weight, M^, must be penal- 
ized approximately 1 pound for every 7 pounds of additional flyback propellant required. 
Slide 12 shows that the optimum trade-off, , between flyback propellant and orbiter 
injected mass calls for a staging altitude roughly 30, 000 ft less than one would use if 
the constraint were not present. The resulting penalty on injected mass is approxi- 
mately 3,000 pounds due to a less fuel optimal trajectory, in addition to the penalty of 
having to carry 140, 000 lbs of flyback propellant. 




TRADE OFF BETWEEN FLYBACK PROPELLANT AND FUEL 


Slide 12 shows the variation of orbiter injected mass, M„, flyback propellant, 

s'; * 

WPFB, and the trade-off, M^', as a function of staging altitude. In Slide 12, the 
trajectory up through staging was a gravity turn. 

Comparison of the traces in Slides 11 and 12 brings out two additional differ- 
ences between the gravity turn and lifting trajectories we have investigated: 

1) Lifting trajectories want to stage lower than gravity turn trajectories 
when flyback propellant is considered. This is because they have less 
curvature and higher flight path angles at comparable staging altitudes. 
Flyback propellant requirements increase about 5000 lbs of flyback 
propellant per degree of flight path angle. 

2) On this particular vehicle, the performance improvement with the 
lifting trajectory was approximately 5000 lbs. Improved performance 
with lifting trajectories was observed on all but one of the vehicles 
investigated during Phase B. However, performance gains were 
usually smaller. 





THE EFFECT OF THE ORBIT ENGINE OUT ABORT CONSTRAINT 

ON PAYLOAD 


Slide 13 shows the effect of the orbiter engine out abort on the staging altitude 
for a particular lifting trajectory (a = 0). The orbiter abort condition considered 
was one engine failure at second stage ignition with the remaining engine operating 
at 109% thrust in parallel with OMS engines. The optimum staging altitude for the 
abort condition is higher than for the nominal trajectory due to the higher gravity 
loss with the lower thrust. 

In trajectory optimization studies, the amount of main propellant for a given 
trajectory is determined for the nominal trajectory. The OMS propellant is then 
determined for the corresponding abort condition and must be traded with payload 
on a 1-1 basis. 



NOMINAL AND ORBITER ENGINE OUT PERFORMANCE 


asa 

cn 


WPFB 
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LIFTING TRAJECTORIES SHOW IMPROVED PERFORMANCE 


Lifting trajectories in which the net applied force on the vehicle was above the flight 
path angle were investigated on six different vehicle configurations during our Phase B 
effort. Gradient techniques were used rather than the more sophisticated variational 
methods; thus, the trajectories produced must be classified as sub-optimal in that 
they do not satisfy formal optimality criteria. However, we were able to show that 
lifting trajectories can pay off, and the methods used were convenient for the assessment 

of important factors other than fuel, such as structural criteria, booster flyback propellant, 

and orbiter OMS propellant needed for the abort situations. 

Slide 14 shows very typical performance gains with lifting trajectories. The pre- 
staging adaptive guidance law noted in Slide 14 is discussed in a later slide and was 
used to maximize orbiter injected mass subject to the booster flyback propellant 
constraint using linear steering. 



TRAJECTORY OPTIMIZATION RESULTS 

AERO MOMENT & REF AREA PRIOR TO UPDATE 


TRAJECTORY 

MAX q 
(PSF) 

WPFB 

(LBS) 

M.(LBS) 

Mf LBS) 

GRAVITY TURN 

540 

134,500 

320,500 

322,640 

Ct= 0 

630 

126, 906 

322,344 

325,575 

a - -i 

565 

131,988 

321,975 

324,479 

a = +i 

796 

124,532 

321,902 

325,472 

a = +2 

1127 

161,683 

319,474 

317,732 

a = 0 WITH 

638 

134,071 

323,410 

325,620 


PRESTAGING 

ADAPTIVE 

GUIDANCE 


SLIDE 14 



TRAJECTORY PERFORMANCE INSENSITIVE TO AERO MOMENT DATA 


Performance gains with lifting trajectories were virtually insensitive to the aero- 
dynamic data (the notable exception being drag). This is a rather important result 
in that this data is very vehicle dependent and difficult to estimate. The result is 
indicated here for a typical revision in the C mQ data shown in Slide 15. Comparison 
of Slides 14 and 16 shows that the 100% change in the C mQ data changed the performance 
analysis by a few hundred pounds . 

The effect of off-nominal C mQ can have a substantial effect on dispersion 
penalties. This is discussed in a later slide. 




LIFTING TRAJECTORY PERFORMANCE DATA 


Slide 16 shows a comparison of performance data for several lifting trajectories 
with and without prestaging adaptive guidance. Comparison of this data with the data 
in Slide 14 shows the minimal effect of C mQ on the trajectory optimization results. 






THE NEED FOR CLOSED LOOP FIRST STAGE GUIDANCE 


Slide 17 shows the sensitivity of ascent fuel and booster flyback propellant require- 
ments to relatively small changes in the center of gravity position and the aerodynamic 
coefficients. These results were generated using no closed loop guidance prior to 
staging. 

The slide illustrates a unique feature of the Shuttle's dispersion problem. In addition 
to ascent fuel penalties for off-nominal conditions, large changes in the booster fly- 
back propellant requirements, iWPFB, also have to be considered. 

Typical sensitivities for flyback propellant are on the order of 5000 lbs per degree 
of flight path angle at staging and about 6000 lbs for a 10, 000 ft change in staging 
altitude. Excess flyback propellant reserves for these conditions trade with payload 
on a 7 to 1 basis. Thus, the payload penalties for excess flyback propellant can be 
substantially greater than the ascent fuel penalty. 



PERTURBATION RESULTS 
WITHOUT PRESTAGING ADAPTIVE GUIDANCE 


RUN 

UwpfbI 

IaMjILI 

NOMINAL 

0 

0 

j-AZ ■ 5 FT 

22,998 

1,194 

Lax = -2. 0 FT 

3,453 

147 

C M = ' 95 C M 

27,301 

1,823 

C N = - 95 C N 

18,699 

3,071 

V‘ 95C A 

10,795 

1,788 
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PRESTAGING ADAPTIVE GUIDANCE SHOULD CONSIDER 


STAGING CONSTRAINTS 


Sensitivity of the flyback propellant requirement to the state at staging makes it 
advantageous to consider this constraint in the prestaging adaptive guidance law. 
Ideally, prestaging adaptive guidance should be fuel optimal subject to the constraints. 

During our Phase B effort, we investigated the use of a linear steering law of the 
form 

0 = 0 o + K(t - t Q ) 

in which the constants 0 and K were selected so as to maximize orbiter mass at 
injection and to make the flyback propellant requirement at staging equal to the 
amount on board. 

Results with and without this adaptive guidance scheme are presented in Slides 17, 
19, 20, and 21 for off-nominal conditions such as winds and vehicle performance. 

No attempt was made to enforce the orbiter engine out abort constraint with pre- 
staging adaptive guidance and the scheme was not compared with other prestaging 
adaptive guidance laws which do not consider the staging constraints. 




R 
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DISPERSION PENALTIES WITH ADAPTIVE GUIDANCE 


Comparison of the dispersion penalties in Slide 19 with those in Slide 17 show that 
a substantial payload saving was realized. The errors in flyback propellant with the 
adaptive guidance scheme were due to minor closing errors in the final seconds before 
staging and the extreme sensitivity of flyback propellant to flight path angle. 

It should be pointed out that this guidance law reduces excess flyback propellants 
as a result of off-nominal conditions during the mated ascent. Excess flyback propel- 
lant reserves will still be needed for off-nominal conditions during entry and cruise. 



PERTURBATION RESULTS WITH ADAPTIVE GUIDANCES 


CG 



RUN 

IaWPFBI 

aM.(LBS) 

NOMINAL 

0 

0 

AZ = -.5 FT 

1030 

593 

ax = "2.0 FT 

50 

0 

r = Q5 f 

|\A 

228 

682 

C N = -95 C N 

899 

435 

C A = ' 95 C A 

188 

687 
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PAYLOAD PENALTIES DUE TO WINDS 


Slide 20 shows the payload penalties due to wind gusts (MSFC Synthetic Wind 
Profiles) without closed loop first stage guidance. The payload penalty of 4, 300 
pounds results from the 2158 pound fuel penalty with the headwind and roughly one 
seventh of the 15, 000 lb excess flyback fuel requirement. 

PAYLOAD PENALTIES 

WITHOUT PRESTAGING ADAPTIVE GUIDANCE 


WIND GUSTS 


aWPFB 

aM, 

HEAD WIND AT 32,800 FT 

+7980 

-1248 

TAIL WIND AT 

32,800 FT 

-8510 

+1167 

HEADWIND AT 

12,600 FT 

-210 

-2158 

TAILWIND AT 

12,600 FT 

+15,000 

+1172 


NET PAYLOAD PENALTY = 1 4300 I 
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WIND PENALTIES REDUCED WITH 
CLOSED LOOP FIRST STAGE GUIDANCE 


Comparison of results in Slides 20 and 21 show the payload saving of approximately 
2500 pounds realized with first stage adaptive guidance. Most of the saving resulted 
from the elimination of 15, 000 lbs of excess flyback propellant. 


co 

co 


PAYLOAD PENALTIES WITH PRESTAGING 
ADAPTIVE GUIDANCE TO INSURE FLYBACK 


WIND GUSTS aWPFB 

aM, 

f 

HEADWIND AT 32,800 FT 

-148 

-1631 

TAILWIND AT 32,800 FT 

+333 

+1653 

HEADWIND AT 12,600 FT 

+43 

j -1788 

TAILWIND AT 12,600 FT 

+333 

-1460 


NET PAYLOAD PENALTY = 1836 
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SURVEY OF AUTONOMOUS NAVIGATION SCHEMES 


FOR DOD SPACE SHUTTLE MISSIONS 
R. J. Farrar 

The Aerospace Corporation 
Los Angeles, California 


This report was not available at the time of 
publication of this conference report. Copies can 
be obtained from the author. 




ENTRY NAVIGATION ANALYSIS 


B. A. Kriegsman and D. E. Gustafson 

MIT C. S. Draper Lab 
Cambridge, Maryland 
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ENTRY NAVIGATION STUDIES 


The basic navigation accuracy requirement stems from the fact that the vehicle must be sufficiently 
close to the selected runway after entry so that it can glide into a safe engines -off landing. 

The primary navigation sensor is an inertial measurement unit (IMU ). Initial-condition errors 

and inertial-instrument errors cause errors in the estimate of the vehicle's state which tend to increase 

during the entry phase. The plasma sheath surrounding the entry body makes state-vector updating by 

external radio navaids very difficult during the major part of entry (from about 150, 000 to 300, 000 feet). 

The hypersonic maneuver capability of the vehicle decreases as the time remaining during entry becomes 

✓ 

small. For this reason it is desirable to correct errors in the IMU -derived navigation data as soon as 
possible before the start of cruise. 

Three particular aspects of the navigation problem are considered here: 

( 1 ) A method for determining the IMU performance requirements 

(2 ) State-vector updating after blackout using VOR/DME and a baro-altimeter 

( 3 ) Stabilization of navigation system altitude channel with drag measurements 
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ENTRY NAVIGATION STUDIES 


OBJECTIVE : 


KEY ITEMS : 


SCOPE : 


Accurate knowledge of position and velocity of SSV during 
the entry phase of mission 

(1) Inertial-measurement unit (IMU) primary sensor 

(2) Radio-transmission blackout (150, 000 - 300, 000 ft altitude) 

(3) Engines-off cruise phase (following entry) 

(4) Vehicle characteristics of both entry body and aircraft 

(1) Performance requirements for IMU 

(2) State-vector updating with VOR/ DME and baro-alti meter 

(3) Altitude-channel stabilization 



RADIO -PROPAGATION BARRIERS FOR ENTRY OF SSV 


A good insight into the radio -transmission blackout problem can be obtained from the radio - 
propagation barrier curves developed by W. Tanner of MIT Draper Lab (more details are in 23N STS 
Memo #11, September 10, 1970). The propagation boundaries, as can be seen, are a function of 
vehicle speed, vehicle altitude, and the frequency of the radio transmission. Each boundary corres- 
ponds to a different transmission frequency. When the vehicle's trajectory lies below the boundary 
for a given frequency, i. e. is in the cross-hatched region, then that frequency cannot be transmitted 
to the vehicle. 

The altitude vs. speed characteristics of typical high-cross -range vehicle trajectories with a 
range of about 5700 n.mi. are shown superposed on the radio-propagation barrier contours. The 
key point to be seen is the strong effect of transmission frequency on the blackout period, i. e. in- 
creasing frequency will decrease the blackout interval. In the particular case shown, 100 mhz 
transmission (VOR) is blacked out between altitudes of about 160, 000 to 385, 000 feet; 10 Ghz trans- 
mission (X-band), on the other hand, is blacked out only between altitudes of about 200,000 and 
300,000 feet. 
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IMU PERFORMANCE REQUIREMENTS --- BASIC ASSUMPTIONS 


To minimize development costs and time, it was decided to keep requirements as close as possible 
to present state-of-the-art. At the present time it is expected that a large number of shuttle flights 

' i 

will be made. For this reason it was felt that on normal missions the post-entry position error should 
be within the specified value at least 99. 9 percent of time. If the same probability were required on 
abort cases, a considerable increase in IMU accuracy would be necessary. Since abort cases should 
occur infrequently, it was felt that a post-entry position -error probability of 95 percent was sufficient 
here. 


To facilitate the analysis of IMU performance requirements for the entry trajectory, the conserva- 
tive and reasonable assumption was made that over the interval of interest the IMU errors (alignment, 
drift-rate, accelerometer uncertainties, etc. ) were all bias errors normally distributed about zero 
mean values. 
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IMU PERFORMANCE REQUIREMENTS- BASIC ASSUMPTIONS 

PERFORMANCE CRITERION : Probability that horizontal -plane position estimation errors 

after entry (h -40,000 ft) are less than a specified value 


GROUND RULES : (1) Hold requirements as close as possible to present 

state of the art 


(2) No external updatings (e.g. radio navaids) are permitted 

(3) The performance criterion for normal entry trajectories 
should be very high (.999)-, on abort cases this can 

be relaxed (.95) 

(4) Consider post-entry errors in range of 5 to 20 nmi 

(5) All IMU errors are bias errors, normally distributed 
about a zero mean value 

(6) No orbit-navigation errors (starting point) 



IMU PERFORMANCE REQUIREMENTS --- ANALYTICAL APPROACH 


The approach adopted was to compute the statistical characteristics of the estimation errors for 
the trajectory of interest by direct foward integration of appropriate matrix differential equations. All 
of the relevant IMU error sources are included, with the individual errors modeled as bias errors 
normally distributed about a zero mean value. The resultant differential equations are linear, but with 
time -varying coefficients. 

The two statistical quantities of prime interest are the estimation-error covariance matrix, and 
the correlation matrix between state estimation errors and IMU errors. Using the eigenvalues of the 
horizontal -plane position estimation- error covariance matrix, the probability that the error is less 
than a specified value is easily computed. The correlation matrix between estimation and IMU errors, 
when properly normalized by the r. m.s. values of the estimation and IMU errors, clearly shows the 
relative contribution of each IMU error source to the total position error. This is very useful as a 
guide to which individual -error specification should be changed. More details are given in MIT Draper 
Lab 23A STS Memo No. 23-71. 



I MU PERFORMANCE REQUIREMENTS-- ANALYTICAL APPROACH 


PROCEDURE : 


(1) Start with state-of-art I MU error model (all bias errors) 

(2) Compute statistical characteristics of estimation errors for 
trajectory of interest (all I MU errors present) 

(3) Use estimation-error covariance matrix (eigenvalues) to 
compute error probabilities 

(4) - Use correlation matrix between estimation errors and I MU 

errors to indicate the predominant and secondary error 
sources 

(5) Modify the individual I MU instrument errors to obtain 

the desired post-entry error probability (guided by correlation 
matrix between estimation and I MU errors) 
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IMU PERFORMANCE REQUIREMENTS --- SIMULATION RESULTS 


Typical simulation results are presented for an abort trajectory on which the vehicle is required 
to return to the earth before injection into a circular 100-n.mile orbit. The total trajectory time dura- 
tion was about 7500 seconds, and the entry range was 5470 n. miles. The statistical models in the 
simulation included drift-rate bias, accelerometer bias, accelerometer scale-factor, accelerometer 
alignment, g-sensitive drift, and east-gyro alignment errors. Both conventional gyrocompassing and 
optical techniques were considered for launch -pad azimuth alignment of the IMU; the leveling of the 
IMU at the launch pad was assumed to be accomplished by the horizontal accelerometers. 

The selected maximum value for the post-entry position error is very important, as can be seen 
by the error-probability data presented for both 8 and 16 n.mile maximum errors. A simulation run 
made using the indicated 1 -sigma IMU errors gave post-entry error probabilities which were too low. 
The correlation matrix between IMU and state -vector estimation errors indicated that the primary error 
sources were launch-pad azimuth alignment, accelerometer bias, and accelerometer scale-factor 
errors. By using optical techniques for azimuth alignment, and by increasing the accelerometer bias 
and scale-factor accuracy requirements by a factor of two, satisfactory post -entry error probabilities 
were obtained. 



I MU PERFORMANCE REQUIREMENTS — SIMULATION RESULTS 


Once-Around Abort Trajectory , HCR Vehicle, II D = 1.5, R ENT =5470 nmi 


Initial I MU Error Model 
(1- sigma values) 


Drift-rate bias 

— .015°/ hr 

G-sensitive drift 

— .04°/ hr/g 

Accelerometer bias 

— . 0016 f Is 2 

Accel, scale factor 

— 50 ppm 

Accelerometer alignment 

— . 11 mr 

East-gyro alignment 

— . 11 mr 

Optical az. alignment 

— .5 mr 


at launch pad 

Level I MU by horiz. accel- 
erometers at launch pad 


• Typical Simulation Data 


Description of 
Test Run 

Probability that 
Post-Entry Position 
Error Less Than 

8 nmi 

16 nmi 

1) Reference case with 

.55 

.90 

initial model (gyrocomp. ) 



2) Improve 

a) optical az. 

.70 

.96 

post-entry 

alignment 



error 

b) reduce 

.68 

.96 

probability 

accel. bias 



by: 

and scale 




factor by 2 




c) optical az. 

.86 

.997 


align & b) 






BAROMETRIC ALTIMETER AND VOR/DME ERROR MODELS 


At altitudes above 100,000 feet the predominant error source in the barometric altimeter is the 
static -pressure error. This error, which is the difference between the free-flow pressure and the 
actual port pressure, is typically of the order of 1 mbar ( 1-sigma). At altitudes below 100,000 feet, 
on the other hand, the predominant error is atmospheric density variations. These variations are 
strongly affected by the temperature of the atmosphere and, hence, vary with latitude, seasons, and 
time of day. A reasonable average error model for this source was felt to be a bias error of 7. 5% of 
density (1-sigma). Instrument errors, i. e. from servos and tranducers, are generally small in com- 
parison to static -pressure and density -variation errors. More details on barometric '■altimeter error 
models are given in MIT Draper Lab 23A STS Memo No. 14-70. 

The VOR/DME combination is a useful navigation aid during entry at altitudes below about 
100, 000 feet. VOR provides magnetic bearing with respect to the ground station, and DME measures 
line-of-sight distance to the ground station. VOR/DME is a particularly attractive navaid for the 
following reasons: 

( 1 ) present coverage blankets the U.S. and is extensive in other countries; 

( 2 ) its accuracy is high enough to significantly improve navigation-system performance; 

( 3 ) it is relatively inexpensive and easy to operate. 

More details on VOR/DME modeling for entry navigation studies are given in MIT Draper Lab 23A 
STS Memo No. 17-70. 
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BAROMETRIC ALTIMETER AND VOR / DME ERROR MODELS 


# BAROMETRIC ALTIMETER 


Type of Error 

Error Model (1-cr) 

1) Static-pressure error 

2) Instrument errors 

3) Density variations 

1 mbar (bias) 

. 2% h (random) 
7.5 % p (bias) 


• VOR/ DME 


Error Source 

Bias (1-cr) 

Random (1-cr) 

VOR 

. 76 deg 

.9 deg (correl. 
noise x = 5-15s) 

DME 

840 ft 

12 ft (4-sec 
sampl. int.) 


VOR acquisition delay .5-1.0 min 


Note : 

1) Data unreliable at Mach nos. between 
0.9 and 1. 1 

2) Pressure too low for h > 130,000 ft 

3) Static-pressure errors dominate at 

h > 100, 000 ft, density vars. dominate 
for h < 100,000 ft 


Coverage Envelope (FAA spec) 






NAVIGATION UPDATING BY VOR/DME AND PRESSURE ALTIMETER 


A series of simulated entry trajectories were run to study the performance of VOR/DME and a 
pressure altimeter as navaids during orbiter entry. The data presented are for a low-cross -range 
vehicle on a normal entry trajectory. A single VOR/DME station is assumed, located at the landing 
point, which is about 10 n. miles down range from the vehicle's position when at an altitude of 40, 000 
feet. A minimum variance filter is used to process the VOR/DME and pressure altimeter data. 

Without the pressure and VOR/DME updating, it is seen that the r. m. s. position estimation errors 
after entry are about 2 n. mi. cross-track, 2.4 n. mi. down-range, and 3.4 n. mi. in altitude. The 
combination of the pressure altimeter and VOR/DME is seen to reduce the post -entry position estima- 
tion errors to about .2 n. mi cross-track, .25 n. mi. down-range, and .28 n. miles in altitude. It is 
interesting to note that the pressure measurement reduces the down-range position error along with 
the altitude error because of the correlation between these two errors. It should also be noted that 
the non-planar characteristics of the entry trajectory, i. e. the lateral maneuvering, provide a favorable 
geometry for DME so that all components of position error are reduced by these measurements. 



NAVIGATION UPDATING BY VOR / DME AND PRESSURE ALTIMETER 


BASIC ASSUMPTIONS • R.M. S. Estimation Errors after Entry (h *40,000 ft) 


1) Normal entry traj. from 
270-mile circular orbit 

2) Apollo-type IMU 

3) Low-cross-range vehicle 
with L/D=0.5 ' 

4) Single VOR / DME station 
at landing site (10 nmi 
down range from 40, 000. ft 
altitude point) 


Measurements Used 

R. M. S. Pos. Est. Errors 

(nmi) 

Altitude 

Cross Track 

Down Range 

None 

3.4 

2.0 

2.4 

Pressure 

:30 

2.0 

1.9 

VOR 

2.8 

.27 

1.4 

DME 

.63 

.67 

.31 

VOR / DME 

.57 

.17 

, -27 

Press. &VOR/ DME 

.28 

.17 

.25 


5) Minimum-variance on- 
board filter, updating 
position only 

6) No pressure updatings 
when h > 150,000 ft 


• R. M. S. Errors from 8 Simulation Runs — Press & VOR / DME 

2-sigma IMU, stat pres, &i.c. errors; 45° N.Lat density vars 
for Jan & July, 1-deg VOR bias, 1000 ft DME errors 


Press. & VOR/ DME 

.21 

.19 

.20 





R. M. S. POSITION ESTIMATION ERRORS FOR NORMAL ENTRY 


Time histories of the r.m.s. errors in the estimates of orbiter position during a normal entry- 
trajectory are presented for the case where a barometric altimeter and VOR/DME are used as navaids. 
Also shown for comparison are the error profiles when the IMU is used alone. A minimum variance 
filter is used to process the pressure altimeter and VOR/DME measurements. 

As can be seen, the pressure measurements come in first, starting at an altitude of about 

150.000 feet. The altitude estimation errors are reduced by a factor of 2-3. DME comes in next at 
an altitude of about 100,000 feet, causing a significant reduction in down-range error from about 

10.000 to 1,500 feet. Finally, at an altitude of about 75,000 feet (acquisition delay) VOR comes in, 
reducing the cross-track position error from about 6,000 to 1, 500 feet. The overall effect of the pres- 
sure altimeter and VOR/DME navaids combination is a reduction in post-entry position estimation 
errors by a factor of about 10 in each component. 



R. M. S. POSITION ESTIMATION ERRORS FOR NORMAL ENTRY 
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STABILIZATION OF NAVIGATION SYSTEM'S ALTITUDE CHANNEL DURING ENTRY 


IMU-derivecJ estimates of vehicle altitude using conventional inertial-navigation techniques diverge 
very rapidly during the latter part of entry. Values of r. m.s. estimation errors as large as 30,000 
feet alter entry have been seen on HCR -vehicle trajectories. The basic objective is to see if the altitude 
estimation errors can be held to reasonable values prior to the end of entry, without requiring any ex- 
ternal navaid updatings or additional navigation sensors other than the IMU. 

Several different techniques have been investigated for accomplishing this. The details are given 
in MIT Draper Lab 2 3A STS Memos No. 10-71, 12-71, 13-71, 14-71, and 26-71. The most promising 
of the techniques studied was the one wherein the weighted difference between measured drag and its a- 
priori estimate was used to update the state estimate. This particular technique is described in more 
detail in the following slides. 





STABILIZATION OF NAVIGATION SYSTEM'S ALTITUDE CHANNEL DURING ENTRY 
PROBLEM DEFINITION 


• I MU-derived estimtes of orbiter altitude tend to diverge rapidly during 
the latter part of entry 

• Stabilize without external navaid updatings and without additional 
navigation sensors (prior to cruise phase) 

POSSIBLE SOLUTIONS CONSIDERED 

1) Remove destabilizing gravity term by feedback of state-vector deviations 
from reference trajectory 

2) Use reference-trajectory gravity in altitude channel (look-up vs speed) 

3) Use reference-trajectory altitude (at est. speed) as current altitude estimate 

4) Update state estimate with weighted difference between measured drag 
and its a-priori estimate 

5) Update with weighted difference between meas. and a-priori est. of drag rate 



DESCRIPTION OF DRAG -MEASUREMENT SCHEME 


The technique first determines a quantity called measured drag (d), using the component of 
PIPA-measured velocity change (Av) along the vehicle's relative -velocity vector (Uy ) in a time inter- 
val (At). The measured drag ( d ) is then compared with an a-priori estimate of drag (d 1 ), and the 
weighted difference is used to update the vehicle's state estimate (x). The computation of d' requires 
that models be stored a-priori of atmospheric density ( P) as a function of altitude (h), and the vehicle's 
ballistic coefficient ( W/C^A) as a function of angle-of -attack in the operating regions of interest. 

In the studies of the scheme, a minimum variance filter was used to update the complete state 
vector (x). To keep the filter design relatively simple, the drag -measurement error model used in 
the filter was a 1 -sigma bias error of 15% ( of drag) and a 1 -sigma random error of 7. 5% ( of drag). 

^ The bias errors were not estimated in these initial studies. Thus far this technique has been used only 

S at altitudes below 200, 000 feet because of the limited available data on density variations at higher 

altitudes. 
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DESCRIPTION OF DRAG -MEASUREMENT SCHEME 


BASIC UPDATING EQUATIONS : 


x 

ar - 


- x' + w (d - d') 


AV • u v / At 


1 


. 2 , 


d' = A P (h* ) V' g (C n A/ W) 
2 c D i 


x - state estimate 
d* = measured drag 
d' - a-priori est. drag 
w = weighting vector 


IMPORTANT CHARACTERISTICS OF SCHEME : 

• Start drag-measurement updating when altitude - 200,000 ft 

• Use minimum-variance filter to update state, no bias estimation 

• Filter model for drag meas. error : 15% bias, 7.5 % random (1-sigma) 


MAJOR PROBLEM AREAS : 

(1) Density variations w. r.t. stored p (h') 

(2) Variations in W 7 C q A from the stored f(a) 
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SIMULATION RESULTS FOR DRAG -MEASUREMENT SCHEME 


A series of simulated entry trajectories were flown for a HCR vehicle to study the performance 
of the drag -measurement scheme. The real-world density -variation model was based on data fdr Cape 
Kennedy w. r. t. 1963 Patrick Reference Atmosphere (details are given in NASA TMX-53872 and in MIT 
Draper Lab 23A STS Memo No. 26-71 ). The 3 -sigma variations go from about 10 percent at an altitude 
of 100,000 feet to about 25 percent at an altitude of 200,000 feet. Ballistic coefficient ( W/ C^A ) varia- 
tions of 10 and 33 percent were considered. 

The particular trajectory studied here was a normal entry for a HCR vehicle with an L/D of 1.5 
and an entry range of about 5400 n. miles. Two-sigma IMU and initial -condition ( at deorbit time) 
errors were assumed. With no drag-measurement updating it is seen that altitude estimation errors 
after entry (h = 100,000 feet) in the cases shown were over 50, 000 feet. When drag -measurement 
updating was used, on the other hand, it was found that the altitude -estimation errors after entry 
(h = 100,000 feet) were only about 5000 feet, even with 3-sigma density variations and 10 percent 
ballistic -coefficient variations. 
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SIMULATION RESULTS FOR DRAG-MEASUREMENT SCHEME 


ASSUMPTIONS : 

• Real-world density var. 
model for Cape Kennedy 
w. r.t. 1963 Patrick 
Reference Atmosphere 
(NASA TM X-53872) 

• Entry traj. — 5400 nmi 
range, 2400 sec 
duration ill D -1.5) 

• Filter error model-— 

15 % drag bias and 
7. 5 % drag random 
(l-o) 

• Start updating at altitude 
of 200,000 ft 


Description 

Density 

w/c d a 

Alt. Est. Errors at 

Vars. 

Vars. ( % ) 

h =150, 000 ft 

h =100, 000 ft 

DNodrag-meas. 

- 

- 

41,680 ft 

62,930 ft 

updating 

- 

■ - 

-39, 101 

-58,825 

2)Drag-meas. 

3o 

-10 

- 6,762 

- 5,066 

update with 3-o 
dens. var. ,10% 
var. W/CqA, 

-3o 

10 

7,120 

4,827 

3 o 

-10 

- 6,700 

- 5,028 

2- o 1 MU and 
initial-cond. 
errors 

-3 o 

10 

6,647 

4,411 

3)Drag-meas. 

5 o 

-33 

-16,000 

-13,350 

update with 
5- odens. var. , 

33 % var W/ C D A 

-5 o 

33 

14,800 

10,423 




ENTRY NAVIGATION ANALYSIS-- SUMMARY 


I MU PERFORMANCE REQUIREMENTS 

• Based on maximum post -entry maneuver capability 

• Compute error probabilities from est. error covariance matrix 

• Dominant errors indicated by correlation matrix between I MU and post-entry errors 

NAVIGATION UPDATING BY PRESSURE ALTIMETER AND VOR / DME 

• Analytical models developed for operational chars, and errors 

• Simulation results show post-entry pos. errors reduced by a factor of about 
10 to . 2 nmi (each component) 

STABILIZATION OF NAVIGATION-SYSTEM ALTITUDE CHANNEL 

• Update state with weighted difference between measured and a-priori estimate of drag 

• Simulation runs show errors of 6000 ft or less after entry 




GUIDANCE AND CONTROL CONSIDERATIONS 
FOR AN UNPOWERED ORBITER 
FROM ENTRY TO TOUCHDOWN 


DAVID W. GILBERT 

MANNED SPACECRAFT CENTER 
HOUSTON, TEXAS 



INTRODUCTION 


Since the orbiter must land on a specific runway and for some missions, at least, will not have 
a cruise capability, it is necessary to have a terminal navigation aid that gives the guidance 
system its position accurately with respect to the runway. In order to make most effective use 
of the available energy, this relative position update should start as soon as possible after 
emerging from entry communications blackout. This paper is concerned primarily with the orbiter 
guidance problem following that first navigation update. An outline of the major topics is 
shown in the first figure. The entry portion of the mission is considered only to the extent 
necessary to account for the range of conditions that might exist at the time of the first 
navigation update. The vehicle ranging capability after that point is determined in the light 
of known and assumed constraints. A candidate strategy for the terminal area guidance target 
and the associated terminal area maneuvering are described. . Finally, some results of a simulator 
evaluation of a specific terminal: area guidance and control system are presented. The paper is 
intended to illustrate the need to consider the overall guidance and control problem from entry 
to touchdown and also to present some specific results from the work in the Guidance and Control 
Division at MSC. The results pertaining to ranging capability are considered typical of recent 
delta-wing high crossrange orbiter configurations, while the terminal area guidance and control 
evaluation was actually conducted with an earlier straight-wing orbiter configuration. 
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GUIDANCE PHASES 


In analyzing the problem, we break the descent portion of the mission after deorbit into three phases. 
First is the hypersonic entry portion that is inertially guided and concerned with getting safely 
through the heat constraints while slowing the velocity and achieving most of the required range. The 
entry portion extends down to the point where the first navigation update is received after communi- 
cations blackout. The actual point at which this occurs depends on the type of communications used to 
transmit the navigation information. For the purposes of thi3 study, it was assumed this would occur 
at an altitude of 150,000 ft. At this point, the second or post-blackout phase starts. During this 
phase, the vehicle is maneuvered onto a course that will intercept a target point in the vicinity of 
the runway at a specified subsonic flight condition. This could occur at an altitude of 55,000 ft 
or less, depending on the target strategy and the initial navigation error to be adjusted. Forty 
thousand feet altitude is shown on the figure for illustrative purpose as the start of the Terminal 
Area Phase. During this phase, maneuvering is performed to adjust the remaining energy so that the 
orbiter enters the final approach plane of the runway with suitable conditions from which it can exe- 
cute an equilibrium glide and flare to touchdown. It must also maintain sufficient energy margin to 
accommodate guidance and navigation errors and unknown winds. 

The following figure illustrates the three guidance phases and also shows the expected time duration 
for this portion of the orbiter missions. Notice that the time of flight for this entire portion of 
the mission is two to four times longer than for a typical Apollo mission. This, coupled with the re- 
quirement to land on a specific runway, results in the requirement for a navigation update. 
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ENTRY PROFILE 

The large crossrange mission results in the longest time of flight. It would be possible to 
straighten out the crossrange component and fly a long downrange mission with the same altitude 
vs velocity profile when the crossrange was not required. This could be targeted to reach the 
same point on the ground as a shorter range trajectory. From a guidance viewpoint, there appears 
to be a number of advantages to doing this, or at least to achieving similar trajectory conditions 
at the time the first navigation update is received. The following, figure shows a typical set of con- 
ditions at 150,000 ft for a short range entry and a long range entry. Notice that at this altitude the 
long range trajectory has farther to go to get to the landing site but it also has greater velocity 
and shallower flight path angle hnd angle of attack. The significant thing from a guidance stand- 
point is to determine the ranging capability from the nominal target after the navigation update is 
received. This establishes the capability to correct for errors, choose alternate landing sites, 
or change the approach path to the existing site. A study was made to evaluate this capability 
from 150,000 ft for the two typical sets of initial conditions. The results show a significant 
advantage for the condition associated with the long range trajectory. It is recognized, however, 
that the long range type of entry also stresses the thermal protection system (TPS) closer to its 
design limit than the short range entry. Depending on the type of material used and other factors, 
there can be a degradation in TPS performance associated with its previous usage history. For 
missions where the large crossrange is not required, there might be other conditions that favor one 
profile or the other. 
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VEHICLE RANGING CAPABILITY FROM 150,000 FT ALTITUDE 


At 150,000 ft altitude, the orhiter would be nominally 200 to 400 n. mi. uprange from the landing 
site, depending on whether it is flying a short range or a long range trajectory and how the tar- 
geting is arranged. The following figure shows the ability to adjust the range after the naviga- 
tion update for the two trajectory cases, assuming both were targeted for the same landing site. 

The footprints shown are at an altitude of 20,000 ft; therefore, there is actually another 15 miles 
or so available. The procedure was to fly an angle-of-attack profile associated with the range-to- 
go starting at 150,000 ft. At this time, a 30° bank angle was held in the proper direction until 
the heading to a particular point was obtained. The vehicle was then rolled wings-level and the 
required angle-of-attack profile continued. In all except the extreme lateral cases in the cor- 
ners of the footprint, the vehicle was on the desired heading to the runway from a hundred miles 
or more out. 

The back edges of these footprints are shown as dotted lines to indicate that they have been cut 
off, and there is some uncertainty in just where the line should be. If it is possible to main- 
tain a 40° angle of attack down to Mach number 1.4, the back or lower edge of the footprint would 
not cut off quite so soon. Also, in determining these footprints, wings were held level from Mach 
number 1.4 to 0.8. This procedure cuts off a small portion of the extreme corners that curl back 
and in toward the center. This amount of cut-off is considered of minor importance. 

Any restrictions on the usable angle cf attack on the front side of the lift-to-drag ratio (L/D) 
characteristic have a significant effect on the ranging capability. 

Most significant of all is the additional 50 to 60 miles of ranging provided by the long range 
type entry trajectory after the navigation update is received. 
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The curved lines. shown in the- following figure indicate the range achieved. for. a constant value of 
L/D maintained from an altitude of 150,000 ft down tb an altitude of 20,000 ft." The two numbers 
associated with each line are the two values of angle of attack associated with - each .4/‘D : ’ value - one 
on the front side of the L/D vs • « curve and one on- the back side (the larger one), as illustrated^ 

We would like to pitch down to the lower, value of angle of attack as soon as possible to eliminate 
the need to keep the reaction control system (RCS) on, but dynamic pressure limitations on the 
vehicle require we stay at the 'larger values of angle of attack until we. reach a Mach number of 1.1 
or less for some conditions. ' " . / ' j.. y ' 

i. . •' . .. ' '* . . - . . 

In the nominal case, the landing site would be' in the middle of the hanging footprint. . IC not, our 
present guidance concept uses the L/D vs contour information to determine the angle of attack to fly 
to adjust the predicted range to the range required- as indicated by the navigation system. The cross 
range capability shown is achieved using bank angles of 30° or. less with wings level from’ Mach number 
1.1 to 0.8. For all but the extreme cases in the corner of the footprint, the vehicle is on the cor- 
rect heading to the runway with wings level well before it reaches transonic flight conditions; 
therefore, a wings-level restriction during this period has only a small effect on the ranging 
capability. 

A horizontal situation display is being developed by using this type of format to provide a means of 
monitoring the guidance system and flying', jit.': manually if desired. 
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ANGLE-OF-ATTACK PROFILES 


At an altitude of 150,000 ft, the orbiter is still operating at an angle of attack greater than 
that associated with maximum L/D in both types of entry. Depending on the situation defined by 
the first navigation update, the orbiter must adjust its L/D and bank angle to achieve the re- 
quired range and heading to the target. Attempts to maneuver to the front side of the L/D 
characteristic at this point (M = 5 to 8, h = 150,000 ft) resulted in excessive dynamic pressure. 
The same L/D can be achieved at larger angles of attack on the back side of the curve, and it 
was found that not only does this result in acceptable dynamic pressures but there is no ranging 
penalty associated with it. At a Mach number of l.U, it is possible to maneuver to the smaller 
angle of attack associated with the same L/D on the front side. This occurs between an altitude 
of 85,000 to 110,000 ft. It might be possible to make this transition to the front side sooner 
in some cases. The earliest acceptable point for each range-to-go was not determined, just one 
common condition that would be acceptable for all cases. The minimum range case was determined 
by the maximum angle of attack that could be maintained from Mach number 5 to 1.1*. This was 
taken as an average value of 1+0°. There is actually a trim limit in this region which is a 
function of Mach number that is not yet well established. The maximum range case was limited by 
the dynamic pressure limit and the L/D available at an angle of attack of 15°. 

In order to achieve the mid-range value or nominal case, the short range type trajectory requires 
a transition from a high angle of attack to a value of 25° to 30° at 150,000 ft altitude, then 
down to 7° at Mach number l.U. For the long range trajectory, no significant change in angle of 
attack is required at 150,000 ft to achieve the nominal, mid-range case. The vehicle is already 
close to 25° angle of attack. For the long and short range cases, the maximum angle-of-attack 
adjustments required are smaller for the long range entry and tend to excite less oscillatory 
disturbance in the trajectory parameters. 

Both types of trajectories reach subsonic flight conditions in the vicinity of 50,000 ft altitude, 
depending somewhat on whether the vehicle is attempting to go long or short after the navigation 
update . 
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CONTROL PROBLEMS AND IMPLICATIONS 

The presently known problems that could affect the guidance capability are listed in the following 
figure. 

The trim a limit is not well defined at this time. It might not be significant at all in the final 
vehicle configuration. These studies assumed an average b0° angle-of-attack limit in the region be- 
tween Mach number 5 and 1.1*. If the actual effect is more severe, it will tend to remove a slice of 
area from the short range end of the footprint. Moderate amounts are not considered serious. 

Lack of vehicle directional stability at large angles of attack requires RCS attitude control at 
least down to 80,000 ft altitude. The coupled lateral-directional motion is stable and will act to 
relieve the sideslip angle, but requires freedom in roll to respond. Whether this is compatible with 
guidance is not yet well understood. If guidance normally requires tighter roll control, then it 
might be necessary to interrupt guidance momentarily and switch control modes to allow the vehicle 
to respond to relieve sideslip angles greater than the RCS can hold. This, in turn, would use up a 
portion of the lateral ranging capability. The effect of this guidance and control interaction needs 
much more detail attention. 

No specific limitations in the transonic region that affect the guidance were defined at the time 
this study was conducted. A wings-level requirement was found to have only a minor effect since the 
vehicle was normally on the correct heading well before it became transonic. Any limitation in 
angle of attack would have a more direct effect. Values between 5° and 10° were used in this 
study. 
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POST-BLACKOUT TERMINAL AREA INTERFACE 


In order to set a guidance target for the post-blackout phase, a maneuvering strategy for the terminal 
area must be defined that accommodates a nominal ease, as well as the minimum energy cases and the 
higher energy cases. The following figure illustrates one possible approach. Notice that the 
scaling is discontinuous since the terminal area portion all takes place within 30 miles of the 
runway, while the post-blackout phase starts 200 to kOO miles out. We first define a minimum 
entry point about t miles out from the runway, at which point one can enter the glide slope and 
still make a normal landing approach. In the example shown, the terminal area target is set approxi- 
mately one turn radius ahead of the minimum entry point so that in the minimum energy case, the 
vehicle could turn directly into the minimum entry point. The nominal case would be arranged so 
^ that the vehicle arrives over the target with a specified altitude and velocity. In this case, the 

cd vehicle would make an initial turn onto a downwind leg, then a final turn onto the glide slope. In 

any event, the terminal phase would actually start when the specified nominal energy state is 
reached. For low energy cases, this would occur before the target is reached, requiring either a 
shorter downwind leg or an earlier initial turn. For high energy cases, the vehicle would pass over 
the target point before reaching the specified energy state and start the initial turn later. At 
this time, it appears that there will probably be a priority list of desirable terminal area maneu- 
vering features that the guidance will accommodate to the extent that the available energy permits. 

In the limiting case, however, it must fly the most efficient flight path that will result in an 
acceptable landing. 
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BASIC FEATURES OF TERMINAL GUIDANCE 


The following figure shows in a little more detail what the current version of the terminal area 
guidance actually does. In general, it always tries to find a two-turn solution to get from where it 
is to an entry to the final approach plane, i.e., the straight-in glide slope. Since there are always 
two possible choices for each turn, i.e., right turn or left turn, there are, in general, four 
possible solutions to the problem. The guidance compares the four combinations of two-turn solutions 
and selects the one that gets it on the glide slope with the greatest altitude. It also shifts the 
solution by the amount of expected wind drift based on input data or its onboard estimate. In some 
situations where the initial state vector lies close to the plane of the runway, a two-turn solution 
does not exist. In these special cases, a three-turn solution is used in lieu of opening the speed- 
brakes and diving off the excess energy. 
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FINAL APPROACH AND LANDING 

The final approach and landing geometry for an unpowered straight-wing orbiter are shown in the 
following figure. Notice that the altitude scale is expanded relative to the range scale for pur- 
poses of illustration. An equilibrium glide path of minus 10° at an airspeed of 2^0 knots is main- 
tained during the approach. Automatic speedbrake control is required to maintain airspeed for the 
automatic mode and greatly eases the pilot task during manual mode steering. The guidance concept 
requires either an actual glide slope beam or a computed pseudoglide slope as a reference for 
steering. At 650 ft altitude, gear and flaps are lowered and a preflare maneuver started to a more 
shallow 2° glide slope. The airspeed is steadily decreasing after this point, and a continuous 
nose-up rotation is required to maintain the flight path. Touchdown velocity is nominally 
150 knots for the particular straight-wing vehicle used in this portion of the study. Actual touch- 
down conditions can be very configuration dependent and related to visibility of the runway just 
prior to touchdown, as well as aerodynamic parameters. 
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VALIDATION TESTS 


A specific terminal area guidance scheme has been evaluated on a hybrid real-time simulator in both 
automatic and manual control modes. It worked well for all nominal and excess energy cases. To 
evaluate it more completely, test cases were devised near the theoretical limit of the vehicle cap- 
ability. Also, an unknown wind was added to the problem. The dotted circle about the minimum entry 
point in the following figure represents the limit of the vehicle capability for the worst case 
orientation with respect to the runway and/or the wind. Test cases were selected at three points on 
the perimeter of the footprint with different orientations, as shown in the figure. These cases 
were flown in both automatic and manual control modes. Of the 18 runs, four arrived at the minimum 
entry point with insufficient energy to land. Subsequent evaluation indicated that moving the start- 
ing point 2 to 3 miles closer would result in all cases making successful landings. The conclusion 
is that this terminal guidance, in its present form, can operate within 10 percent of the theoretical 
limit of vehicle capability. 
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TERMINAL AREA DISPLAY 


Some effort has been directed toward the development of a terminal area energy management display 
to enable the crew to monitor the system in an overall way and to fly the approach manually if 
desired. It consists of the contour shown in the following figure and a series of semicircles 
representing final approach turns that lead onto the glide slope at different altitudes as shown. 
The orbiter should nominally cross the outer contour at an altitude of 20,000 ft or greater. If 
so, it flies at the airspeeds indicated. If not, it flies at maximum L/D all the way in. The 
contour is designed to take into account the approach heading with respect to the runway and the 
corresponding altitude loss in the turns required to get on the glide path. In use, the vehicle 
ground track would be superimposed on the display, and the pilot would fly to intercept one of 
the final approach turns. The three cases shown are near minimum energy cases that intercept 
some part of the last possible final approach turn. Higher energy cases would make an initial 
turn onto a downwind leg until the vehicle altitude coincided with the altitude to start the 
final turn. In conjunction with the usual altitude, airspeed, and heading information, this 
type of display could be used to monitor the system or fly a manual approach. 
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TOUCHDOWN PERFORMANCE RESULTS 


The terminal area guidance also includes the flare and touchdown. Several unpowered landing evalua- 
tions were flown on the simulator in three manual control modes and a fully automatic mode. The re- 
sults are summarized in the following figure. Pilot ratings and performance results both indicate a 
clear advantage for the rate command, attitude hold mode for manual control. The particular 
straight-wing orbiter vehicle simulated had very slow short-period response and both of the closed- 
loop, rate-command-type control modes made a significant improvement. Actually, the bare airframe 
simulated would be judged adequate by military specifications and relative to some existing commer- 
cial transport aircraft. The indication is that the unpowered landing requires something better 
than presently accepted minimum response requirements. Ground effect and visibility of the runway, 
however, have a significant influence on what is minimally acceptable. A more than adequate closed- 
loop fly-by-wire control system, which provides response in the middle of the Level 1 military require- 
ments, avoids the whole problem. 

The touchdown parameters and stardard deviations are summarized in the figure. These are all for 
undisturbed nominal cases, i.e., no winds or gusts. The manual runs used the rate command, attitude- 
hold control mode. X is the distance down the runway when touchdown occurred. Y is the distance 
from the centerline. A significant result is the much smaller deviations from the mean for the auto- 
matic mode. The mean value for the auto mode depends primarily on how the system was targeted. An 
objective was to attempt to contain the landing problem to the first 2000 ft of the runway. In the best 
manual mode, the three-sigma dispersions if valid are marginal, but even this performance required range 
markers on the runway. This made a significant improvement. 
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GUIDANCE CONCEPTS FOR SSV ORBITER 
REENTRY TO TOUCHDOWN 


Ames Research Center has been investigating navigation and guidance concepts to bring the 
Space Shuttle Vehicle (SSV) Orbiter from the end of reentry, which is assumed to be 100,000 
feet to touchdown. Both automatic and manual systems are being considered for the unpowered, 
high-cross range (HCR) vehicle. Conceptually, two different guidance and control systems are 
used during the mission. At high altitudes, an Energy Management System is used to guide the 
vehicle to a specific altitude and distance from the runway with the desired heading and 
velocity. An Approach, Flare, and Runway Alignment System then guides the vehicle to touchdown. 

The navigation and guidance concepts described in this paper were developed by Sperry Flight 
Systems Division (Contract No. NAS2-5084) and Bell Aerospace Corporation (Contract No. NAS2- 
6077) under contract to Ames Research Center. Sperry has developed concepts to guide the SSV 
from the end of reentry to touchdown. They have considered both the automatic and manual systems 
and have implemented these systems on a moving-base simulator at Ames. Due to the critical 
nature of the flare and runway alignment maneuver for the unpowered SSV, a second contract was 
negotiated with Bell to conduct an independent investigation to define the navigation and guidance 
concepts from initial flare to touchdown for the automatic mode only. 

Ames has initiated a detailed program to evaluate the concepts. The data presented in this paper 
was obtained during the initial phase of the evaluation. All data was obtained using the North 
American Rockwell high-cross range (NAR-HCR), twin-fin configuration. However, the basic concepts 
should not vary drastically with different configurations. Ames will continue not only to evaluate 
the concepts using different configurations but also to develop the concepts described here since 
time did not permit the contractors to refine their systems. 
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ENERGY MANAGEMENT 
SPERRY SYSTEM 


The system being used to guide the SSV during reentry would nominally bring the vehicle to a 
position on the target circle with the proper velocity, headed toward the center of the circle. 

The end of reentry is assumed to be at an altitude of 100,000 feet. For this study using the 
NAR-HCR twin-fin configuration, the vehicle at this altitude would be positioned on a target 
circle of radius about 400,000 feet with a velocity of approximately 3,000 feet/second. The 
center of the reentry target circle is located at 137,000 feet from the runway on an extension 
of the runway centerline. 

The target circle is well within the vehicle maximum range surface which, at an altitude of 100,000 
feet, is approximately circular with a radius of about 660,000 feet. If the vehicle is beyond the 
maximum range surface, it cannot reach the 20,000 feet altitude with the proper velocity, direction 
and range from the runway. The vehicle could be outside the surface and still have the capability 
of reaching the runway. 

The objective of the energy management system is to bring the vehicle to an altitude of 20,000 
feet at a range of 137,000 feet from the runway with the desired velocity and headed toward the 
runway. 

The Sperry concept for energy management at high altitudes is reference trajectory guidance. A 
reference trajectory is stored in the on-board computer. Thus, the current vehicle energy (i.e., 
velocity and altitude) is compared with the reference trajectory values to obtain a measure of 
the vehicle status. The vehicle flies along a path tangent to the surface of the targeting cylinder 
whose center is located at the center of the reentry target circle. If excess energy exists, the 
radius of the targeting cylinder is increased to alter the direction of vehicle flight. This change 
in direction increases the total path length the vehicle must traverse allowing the excess energy 
to be dissipated. 

Nominally, the vehicle will arrive at the targeting cylinder at an altitude of 50,000 feet and a 
velocity of 900 feet/second with an excess of energy. The vehicle is guided around the targeting 
cylinder until it is headed away from the runway. If the proper energy exists, the vehicle continues 
to make a 180° turn and begins tracking the final glide slope. However, if an excess amount of 
.irrgy exists, the vehicle is guided on a path directed away from the runway until the excess energy 
is dissipated before turning into the final glide slope. 
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EXAMPLE ENERGY 
MANAGEMENT TRAJECTORIES 


Two example trajectories indicating the performance of the energy management system are 
shown here. The vehicle is initially located on the target circle at the end of reentry 
with nominal velocity and direction. (No winds have been introduced.) The solid line shows 
a run initially headed toward the runway while the dotted line shows an initial heading 
perpendicular to the runway. In both cases, the energy management system makes a high 

altitude energy correction by commanding the vehicle to fly a path tangent to a larger 

than minimum radius targeting cylinder. The excess energy is rapidly dissipated and the 
vehicle begins to fly a path tangent to a targeting cylinder of constant radius. When 
the vehicle is headed directly away from the runway, excess energy in the form of excess 
altitude exists. The vehicle is guided away from the runway to dissipate this energy before 

being commanded to turn 180° and begin final approach. The run where the initial heading is 

perpendicular to the runway has a larger amount of excess energy and consequently must travel 
a greater distance from the runway before turning into the final glide slope. This greater 
amount of energy is shown in the figure by the higher altitude at X = -137,000 feet for this run. 
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GUIDANCE SYSTEM PERFORMANCE WITH OFF NOMINAL 
INITIAL CONDITIONS AND WIND 


The results presented here show the effect of initial position errors and winds on the trajectory. 

In all cases, the trajectory begins at the nominal altitude, velocity and heading. However, the 
initial position of the vehicle is off the target circle. The runs will be discussed in the order 
from top to bottom. 

The first run is initially positioned on the reentry target circle (X = 530,000 feet). The influence 
of winds on the trajectory is observed by comparing this run with the example described previously. 

For example, the vehicle does not have excess energy to dissipate when it gets to the point on the 
targeting cylinder where it is headed away from the runway. Consequently, in the wind case, the 
vehicle continues to turn until it is tracking the glide slope. 

The initial position for the second run is beyond the reentry target circle (X = 630,000 feet) which 
implies a lower than nominal energy condition. The vehicle initially flies a path that is tangent 

to the targeting cylinder. When it reaches the cylinder, the vehicle does not have enough energy to 

go around the cylinder and proceeds dirdctly in toward the runway. 

The third run shows the vehicle starting closer to the runway than nominal (X = 430,000 feet). Con- 

sequently, the vehicle has an excess amount of energy. The vehicle begins to fly a path tangent to 
a targeting cylinder with a large radius until the excess energy is dissipated. The radius of the 
targeting cylinder begins to decrease until the vehicle eventually flies a path tangent to a targeting 
cylinder of nominal radius. The maneuver around the targeting cylinder and into the approach glide 
slope is completed in a normal manner. 

The fourth run shows the vehicle starting even closer to the runway (X = 330,000 feet) than run 3 
which results in a more severe excess energy state. Although more severe, the vehicle essentially 
completes the same type of trajectory as in run 3. 

The performance of the system has been investigated for other conditions such as the effect of 
atmospheric density variations, weight increases, L/D variations, unknown winds, and initial condition 
•errors. In all cases, except the initial condition errors, the effect of these variations on the 
trajectory has been small. The evaluation of the energy management system is not complete; nevertheless, 
it has uncovered some possible refinements that could be made. For that reason, Ames will continue 
to both evaluate and develop the system. 
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GUIDANCE SYSTEM PERFORMANCE WITH OFF NOMINAL 
INITIAL CONDITIONS AND WIND 
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APPROACH, FLARE, AND RUNWAY ALIGNMENT 
SPERRY SYSTEM 


The geometry for the Sperry approach, flare, and runway alignment system is shown. The approach 
system is a fixed path guidance scheme. The vehicle is guided along a -10° glide slope at 
equilibrium velocity to an altitude of approximately 1700 feet. At this altitude, a constant 
"g" pitch maneuver is then initiated to flare the vehicle to a shallow glide slope of -2.5 . The 
vehicle is constantly decelerating as it approaches the runway on the shallow glide slope. At 
an altitude of 300 feet, the gear is lowered. A final flare is initiated at an altitude of 45 
feet to reduce the high sink rate, with the runway alignment maneuver (decrab) occurring at an 
altitude of 5 feet from touchdown. The nominal touchdown sink rate is 1.7 feet/second and air 
velocity is 333 feet/second (197 knots). 
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APPROACH, FLARE, AND RUNWAY ALIGNMENT 

SPERRY SYSTEM 


• FIXED PATH GUIDANCE 
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FLARE AND RUNWAY ALIGNMENT 
BELL SYSTEM 


The Bell flare and runway alignment system is a predictive guidance scheme. The system 
predicts the point at which each event (i.e., initial flare, final flare) should occur as a 
function of the vehicle's current state and the environmental conditions (winds). For example, 
initial flare nominally occurs at an altitude of 1085 feet and a range of 21,000 feet. However, 
if a tailwind exists, the initial flare will occur at a higher altitude and further from the 
runway. Conversely, if a headwind exists, the flare will occur at a lower altitude and closer 
to the runway. 

The landing gear is used for velocity control. Nominally, the gear is lowered at an altitude 
of 400 feet. The gear is lowered at a higher altitude if the vehicle is high and, conversely, 
at a lower altitude if the vehicle velocity is low. 

The final flare to reduce sink rate nominally occurs at 100 feet altitude and the decrab maneuver 
occurs at an altitude of 8 feet. Nominal touchdown sink rate and air velocity are 2.9 feet/second 
and 276 feet/second, respectively. 



FLARE AND RUNWAY ALIGNMENT 
BELL SYSTEM 
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EFFECT OF TURBULENCE AND MEAN WINDS ON 
TOUCHDOWN PERFORMANCE: SPERRY SYSTEM 


A preliminary evaluation of the two flare and runway alignment systems is provided by the data 
presented in the figures. The effect of mean wind and turbulence on the performance of the system 
at touchdown is shown for the most significant states. The mean wind varies with altitude, 
which introduces a wind shear. The turbulence model was the Dryden model suggested in MIL-F-8785B. 
(Note: Each mean wind case includes 10 individual runs.) 

The data presented for the Sperry system indicates the following: (1) The longitudinal (X) and 

lateral (Y) dispersions are relatively large. These dispersions result partially, at least, from 
the low nominal sink rate (1.7 ft/sec) at touchdown. Sperry is currently investigating the 
possibility of both increasing the nominal sink rate at touchdown and incorporating additional 
logic in the flare law to reduce the dispersions. (2) When a tail wind exists, the vehicle lands 
the greatest distance down the runway and at the highest velocity. Based on recent studies, these 
results indicate that for a runway of length 10,000 feet, the distance remaining to stop the vehicle 
is sufficient if a drag chute is used but marginal, depending on the runway surface condition, if a 
chute is not used. (3) The dispersions in air velocity indicate the effect of no velocity control. 
Speed brakes, which exist on other configurations, would certainly reduce the dispersions. 
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EFFECT OF TURBULENCE AND MEAN WINDS ON 
TOUCHDOWN PERFORMANCE^ SPERRY SYSTEM 
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EFFECT OF TURBULENCE AND MEAN WINDS ON 
TOUCHDOWN PERFORMANCE: BELL SYSTEM 


The data presented for the Bell system shows the following: 

(1) Relatively small longitudinal dispersions, possibly resulting from the higher 
nominal touchdown sink rate and the velocity control achieved by lowering the 
landing gear at the appropriate time. 

(2) The large lateral dispersions partially result from a reduction in control 
power when landing at a lower speed. For example, the nominal air velocity at 
touchdown is 276 ft/sec for the Bell system and 333 ft/sec for the Sperry system. 

(3) The effect of lowering the landing gear and moving the aim point for initial flare to 
obtain velocity control is observed in the relatively small air velocity dispersions. 
Achieving velocity control in this manner does reduce the requirement for speed brakes. 
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ERROR MODELS FOR AND LOCATION OF 
GROUND NAVIGATION AIDS: BELL 


The effect of state estimation errors on the performance of the Bell system has also been 
investigated. The navigation system consists of an inertial navigator on-board the SSV, 
updated with ground based guidance aids. The error model for the microwave scanning beam 
landing guidance system (MSBLGS) is comparable to the error model obtained from flight test 
of the system installed at NAFEC. The error model for the tracking radar corresponds to 
the Bell SPN-42 system. 

The location Bell assumed for the transmitters is also shown in the figure. The localizer 
was positioned 2000 feet down the runway from the nominal touchdown point and 200 feet to the 
side for this phase of the study. All future studies will have the localizer positioned at 
the stop end of the runway. 

The vehicle's state is estimated by combining the INS and ground-based information, using a 
blending algorithm. The blending algorithm is a quadratic complementary filter. 



213 


ERROR MODELS FOR AND LOCATION OF 
GROUND NAVIGATION AIDS: BELL 


SYSTEM 

RANGE 

(FEET) 

ELEVATION 

(MILLIRADIANS) 

AZIMUTH 

(MILLIRADIANS) 

NOISE(l<r) 

BIAS «<r) 

NOISE(ltr) 

BIAS(lcr) 

NOISE(lo-) 

BIAS(itr) 

MICROWAVE 
SCANNING 
BEAM LGS 

75 

10 

0.61 

0.87 

0.39 

0.63 

TRACKING 

RADAR 

8 

s 

0.3 

0.3 

0.3 

0.3 


MICROWAVE SCANNING BEAM LANDING TRACKING RADAR 

GUIDANCE SYSTEM (MSBL6S) CTR) 



POINT TRANSMITTER POINT 



EFFECT OF MEASUREMENT ERRORS ON 
TOUCHDOWN PERFORMANCE: BELL SYSTEM 


The dispersions at touchdown resulting from the state estimate errors indicate the longitudinal, 
air velocity, and altitude rate dispersions are somewhat less than the dispersions caused by 
mean wind and turbulence. The lateral dispersions are considerably less than the dispersions 
caused by mean wind and turbulence. Also, the longitudinal and lateral dispersions for the 
system using the tracking radar are approximately one-half the dispersions obtained when using 
the scanning beam system. 



EFFECT OF MEASUREMENT ERRORS ON 
TOUCHDOWN PERFORMANCE: BELL SYSTEM 
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SIMULATOR 


All concepts described have been for the automatic system. As previously indicated, the 
system designed by Sperry has been implemented at Ames on a moving base simulator with an 
outside visual scene. The figure shows a photograph of the simulator. 

Information for the pilot is displayed primarily on two indicators: The Electronic 
Attitude Display Indicator (EADI) located on the panel and the Horizontal Situation 
Indicator (HSI) located between the pilot's legs. The EADI displays attitude information, 
heading, altitude, and air velocity. Also, command (vertical and horizontal lines) and 
situation (rectangle near center of EADI) data is displayed. The HSI displays the 
vehicle's X and Y position as well as heading information. Additional information such as 
angle of attack (a), Mach number, and glide slope (y) is displayed on the meters located 
around the EADI. 

The figure also shows the hand controller used for the manual control modes. The simulator 
has the capability for mechanizing flaps, speed brakes, and throttle. 

The simulator is used to evaluate both the automatic and manual systems from 100,000 feet 
altitude to touchdown. 







CONCLUSIONS 


The concepts described in this paper are capable of bringing the SSV from the end of reentry 
to touchdown. The concepts have not been optimized and continue to be developed by both 
contractors and Ames Research Center. 

The results from the preliminary evaluation indicate the systems must be refined. The concepts 
will be evaluated in considerably more detail, especially with other candidate SSV configurations. 
Although all the data presented was obtained using the NAR-HCR twin-fin configuration, the concepts 
should not vary greatly for other configurations. 
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Ames SSV RAINPAL Navigation Study 


Ames Research Center is conducting a navigation study program called RAINPAL - an 
acronym for Recursive Aided Inertial Navigation for Precision Approach and Landing - which 
will provide navigation information which is applicable to the stringent requirements of 
the unpowered SSV High Cross Range (HCR) orbiter. 

The objective of this study is to determine the navigation accuracy obtainable with an 
augmented INS (Inertial Navigation System). Augmentation of the INS is through the use of 
a Kalman filter (square-root form) which processes external data from several candidate data 
source combinations. 

The approach used in this study is one which has three basic phases. The first was the 
analysis phase. In this phase a specific set of inertial navigation equations was selected 
which produce navigation information in a runway coordinate system. This phase also involved 
development of other formulations such as the equations for the Kalman filter transition matrix 
and error models for various sensors. The second phase was the development of an IBM 360/67 
simulation program which would form the basis for studying the basic concepts and the develop- 
ment of new techniques for filter mechanizations. The results to be presented in this paper 
were generated by this simulation program. The third phase involves the verification by 
flight test of the concepts being developed. The on-board program is at present approaching 
operational status. 



AMES SSV RAINPAL NAVIGATION STUDY 


OBJECTIVE: 

• DETERMINE NAVIGATION ACCURACY 
OF AN AUGMENTED INS 


APPROACH: 

• ANALYSIS 

• SIMULATION 

• FLIGHT TEST 
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Illustration of RAINPAL Mechanization 


This slide is an illustration of the RAINPAL mechanization. Specific forces are 
sensed by the IMU and the resulting acceleration signals, a, are integrated over a period 
of 1/20 second to produce changes in velocity, aV. These velocity changes are then used 
by the navigation equations in the on-board digital computer to compute the estimated 
vehicle state in the runway coordinate system. Because of the relatively poor long term 
stability of an INS, the estimated state must be corrected by the use of external measurements 
such as ground navigation aids. In addition, the inherent instability of the vertical 
channel requires the stabilizing influence of devices such as a barometric altimeter since 
information about the vertical position may not be available from other ground navigation 
aid measurements. 

All measurements are processed by a Kalman filter which, in the results presented in this 
paper, up-dated the state estimate every two seconds except as will be noted. 

The accuracy of the state estimate is, of course, related to how well the error models 
used actually represent the errors in the various navigation aids. Recognizing this fact, 
the personnel involved with the RAINPAL study program are continuously attempting to refine 
the error models presently in use. 
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ILLUSTRATION OF RAINPAL MECHANIZATION 
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Candidate Ground Navigation Aid Combinations Investigated 


This slide lists the five candidate ground navigation aid combinations which were 
investigated in this paper. Each of these candidate combinations has been proposed as 
possible sources of navigation information which could be used for the SSV HCR orbiter. 

There is considerable motivation to use navigation aids whose accuracy and 
reliability are established. These navigation aids also generally offer lower cost 
and are readily available but have the disadvantage that no single system is capable 
of providing the necessary navigation information throughout the entire mission. There 
is also motivation to use new navigation aids which may be expected to be in general 
use in a few years or to use others which offer the ability to provide navigation 
throughout the entire mission with a single system. The relative navigation performance, 
particularly during approach and landing, of the various aids and combinations of aids 
must be established. Once this is done, the candidate aids can be compared with the 
required performance specifications and the system with the least economic impact 
selected. 

Of the five candidate systems, only one of the navigation aids listed may be unfamiliar 
to many readers. This aid has been called MACDME which stands for Maximum Accuracy 
Compatible DME. This is a new low-power, low-cost, high-accuracy DME being developed by 
the FAA for short range use in conjunction with terminal VOR's and with ILS. 
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Ground Navigation Aid Geometry 


The landing site for the SSV orbiter in this study is runway 22 (224° magnetic) at 
Edwards Air Force Base. The orbiter approaches the runway on an energy management trajectory 
which starts at 100,000 feet with a velocity of 3,000 ft. /second and lands with a velocity 
of 263 ft. /second down the runway and a sink rate of 2.69 ft. /second. The touchdown point 
is 1,000 feet from the threshold of this runway whose length is 15,000 feet. 

The ground navigation aids which were used for this part of the study are: (1) a 

conventional ILS whose localizer antenna is located at the stop end of the runway 15,000 
feet from the touchdown point and whose glide slope antenna is located so as to provide the 
proper 3° glide slope; (2) a Tacan station located 6.7 miles from the runway threshold along 
the approach path; (3) a V0R station located 7.6 miles from the runway threshold along the 
approach path; (4) a MACDME co-lo’cated with the V0R station; and (5) two V0RTAC stations: 
one located at Palmdale; the other located at Hector. 

For combination I, V0RTAC data from Palmdale and Hector are used initially. As the 
vehicle comes within 25 miles of the Edwards V0R, data from both the Edwards V0R and the 
Edwards Tacan are added as data sources. Continuing further, as the vehicle reaches 20,000 
feet altitude, data from the ILS localizer is also added as a data source. Upon approach to 
the Edwards V0R tone of confusion'!, the Edwards V0R and Tacan are dropped as data sources. 

When the vehicle intercepts the 3° glide slope at a little more than 4 miles from touchdown, 
the ILS glide slope signal is added and the two VORTAC stations are dropped as data sources. 

The ILS localizer and glide slope continue and are the only ground data sources of navigation 
aid data until approximately 100 feet altitude when the glide slope signal becomes unusable 
and is terminated, leaving only the localizer until touchdown. 

Combination II differs from combination I in that the MACDME is added as a data source 
at the same time the Edwards VOR and Tacan are added and remains as a data source until touchdown. 

The geometry shown in this slide is to scale with the exception of the Hector VORTAC 
which was moved about 17 miles west for illustration purposes only. 
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GROUND NAVIGATION AID GEOMETRY 
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State Estimation Error at Touchdown for Candidate Ground Aids I and II 


The range of state estimation errors at touchdown which were obtained from 5 Monte 
Carlo runs for candidate ground aids I and II are shown. In both cases, the X (down 
runway) and Z (altitude) errors are rather large. The Y (across runway) errors are also 
quite large but might be acceptable when it is taken into consideration that the range of 
the across runway errors can be expected to be directly proportional to the unusual 
M distance of the localizer antenna from the touchdown point - 15,000 feet in this instance, 

os However, further analysis is indicated before it can be determined conclusively that ILS 

° would not be adequate for the SSV. 

Use of the MACDME resulted in an improvement in performance in the X and Z directions 
but, because of the location of the MACDME underneath the approach path, no additional 
information was available to the navigation system for improvement of performance in the 
Y direction. Further studies with MACDME should include locating the MACDME next to the 
ILS localizer antenna. 
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Ground Navigation Aid Geometry 


This slide is basically the same as a previous slide except that it shows only the navi- 
gation aids used for combinations III and IV. The energy management trajectory is the same. 

Combination III assumes an RTCA SCI 1 7 MSBLGS azimuth scanner located at the stop end 
of the runway 15,000 feet from the touchdown point and an elevation scanner 2,000 feet 
past the touchdown point and 200 feet to the left of runway 22. Initial data sources 
£j> are the two V0RTAC stations at Palmdale and Hector. Upon descending to 20,000 feet altitude, 

so the two V0RTAC stations are dropped as data sources and the range, azimuth and elevation 

from the MSBLGS are picked up as data sources and used until touchdown. 

Combination IV replaces the two V0RTAC stations with two radar trackers as data sources. 
The radar trackers are an FPS-16 and an MPS-19 located about 5 miles to the right of runway 
22. As in combination III, the radar trackers are dropped as data sources at 20,000 feet 
altitude in favor of the MSBLGS. 
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State Estimation Errors at Touchdown for Candidate Ground Aids III and IV 


This slide shows the range of state estimation errors at touchdown for candidate ground 
aids III and IV. These data indicate that the navigation performance with the RTCA SCI 1 7 
MSBLGS is essentially unaffected at touchdown by any differences in navigation performance 
with either VOR/DME or tracking radar which may have existed at 20,000 feet altitude. 

Both of these candidate ground aids exhibit improved navigation accuracy over the ILS 
in candidates I and II (note change in scale). When the results of further studies with 
these candidate aids are completed, it is expected that they will show conclusively that 
they will be adequate for SSV at touchdown. 

The MSBLGS azimuth scanner - like the ILS localizer antenna - is located 15,000 feet 
down the runway from the touchdown point. The accuracy of the cross runway information 
obtained from the azimuth scanner, also like the ILS, is reduced by greater distances from 
the vehicle to the azimuth scanner. 
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Ground Navigation Aid Gebmetry 


Edwards Air Force Base is shown with three energy management trajectories and a 
pattern of five precision range system transponders located on the ground below. The 
two additional trajectories were included to determine if navigational accuracy is 
sensitive to the particular trajectory used. All three of the trajectories had 
approximately the same initial conditions - 100,000 feet altitude and a velocity of 
3,000 feet/second. The initial true heading of each trajectory is shown. 

The pattern of transponders was chosen intuitively based on previous experience. 
No optimization of location was attempted. 

The antenna on board the SSV was assumed to be located on the underside of the 
vehicle and to have a hemispherical coverage with the ranges used in this study. The 
effect of vehicle "shadowing" in turns was taken into account in the simulation. Only 
the two closest unshadowed transponders were used at any time. 
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State Estimation Errors at Touchdown Candidate Ground Aid V 


The range of state estimation errors at touchdown for candidate ground aid V indicate 
that, at the level of significance obtainable with 5 Monte Carlo runs, there is little 
trajectory sensitivity among the three trajectories investigated. 

The effect of data rates was found to be of considerable significance in this study. 
During the final approach to landing, the SSV passes over transponder five at low altitude 
and relatively high velocity. Under these conditions, and with a data rate of one range 
sample every two seconds, the likelihood of obtaining adequate vertical information from 
this transponder proved to be very low. In order to overcome these difficulties, the data 
rate using this transponder was increased from h to 8 per second insuring adequate vertical 
information from this transponder and reducing the range of Z position error by a factor of 
about 4 and the X error by a factor of about 2. No data rates other than the 4 and 8 per 
second were studied. 

The operational implication of the higher data rate on the on-board computer is that 
additional computational capability would be required to increase the cycle rate of the 
Kalman filter. This does not mean that the Kalman filter would have to process 16 times as 
much data unless all other measurements were also processed at the higher rate. Instead it 
would mean only a modest increase in computational capability - easily within the capability 
of modern computers . 

The results shown indicate that a more exhaustive study will conclude this candidate 
system is adequate for SSVU providing a higher data rate is used in the Z channel on the final 
approach. It is also implied by the results obtained here in the Z and X directions that a 
higher data rate for all transponder measurements might reasonably be expected to improve the 
navigation accuracy in all directions. 
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Estimated Standard Deviation of Errors at Touchdown 


This slide compares the estimated standard deviation of errors at touchdown for all five 
candidate ground aids. 

It should be emphasized that the results presented are preliminary and, with the level 
of significance obtained from 5 Monte Carlo samples, care should be exercised in ranking the 
various combinations used. This is particularly true when, as in these studies, no attempt 
has been made to optimize the filter weighting for each of the candidate ground aids to account 
for parameters which are not included as state variables. Furthermore, it should be pointed 
out that, in all the candidate ground aids studied, the barometric altimeter was given relatively 
little weight as a measurement device, particularly during the final approach. This allowed the 
barometric altimeter to have the desired stabilizing effect at high altitude and essentially 
forced each candidate system to stand on its own merits. The effect of data rate on the 
estimation performance of the filter with each of the candidate ground aids must be investigated 
further. It is possible that, with a proper choice of filter weighting and data rate, the 
navigation precision afforded by the augmented INS may. allow sufficient navigation precision 
to be obtained with all of the candidate systems. The final selection of a system then may 
well be determined more by economic considerations than by technical considerations. 

Ames plans to continue actively with further investigations into the candidate ground aids 
and publish the results in the near future. These investigations will also include flight test 
of the RAINPAL system. The results of these tests will be reported promptly. 
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97 

20 

El 

wm 

0.50 

0.12 

m. VOR/DME- MSBLGS 

12 

15 

3.7 

0.39 

0.24 

0.42 

JSL. RADAR TRACKERS -MSBLGS 

13 

9.5 

2.8 

0.17 

0.43 

0.47 

3Z. PRECISION RANGE SYSTEM 
(5 TRANSPONDERS) 

240° 

0.96 

7.0 

2.9 

0.070 

0.092 

0.075 

330° 

1.5 

9.5 

3.3 

0.046 

0.16 


60° 

1.6 

5.4 

3.8 

0.12 

0.073 

0.046 


NOTE: 5 MONTE CARLO RUNS 
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Error Models for Barometric Altimeters 


Two barometric altimeters were assumed to be on-board the SSV; one for 0 to 100,000 
feet range and a second for the 0 to 10,000 feet range. 

The barometric altimeters are subject to the following error sources: (1) non-standard 

atmosphere; (2) pitot-static; (3) random instrument errors; and (4) time lag. 

The non-standard atmosphere is the deviation of the actual atmosphere from the atmospheric 
model to which the altimeter was calibrated. When the altimeter is corrected to read zero at 
the landing site, the 1-sigma variation of the deviation from the reference is approximated by 
a linear variation from zero at the landing site to 2% at 100,000 feet (reference 1). 

The pitot-static errors are due to static port errors and other errors in the sensing system 
not associated with the altimeter itself. For an altimeter system which might by typical for 
SSV application a pressure coefficient, Cp, of +.005 (max) seems reasonable. If it is assumed 
that Cp = +.005 is a 3-sigma variation, then an expression for the 1-sigma altitude error Ah is 



where: Cp = static pressure coefficient 

V = true airspeed, 
g = 32.2 ft. /sec. 

The random instrument errors are due to variations in the instrument which cannot be 
calibrated (altitude dependent) and on random noise on the output voltage. 

Time lag errors are dependent on the altitude and the rate of change of the altitude. They 
are mainly due, to the time required for pressure in the system to reach equilibrium. The best 
information at present is that these errors can be compensated for in the computer and therefore 
are not included in the model. 



ERROR MODELS FOR BAROMETRIC ALTIMETERS 


ERROR SOURCES: 

I. NON-STANDARD ATMOSPHERE 


Ah = 


2X10 


-7 


( I cr) 


p g 

h = ALTITUDE 

p = ATMOSPHERIC DENSITY 


2. PITOT-STATIC 


P”P 

ASSUME C P = — § = ±0.005 (max) 

p t p s 


. Cp/3 

Ah = -- P - - --(lor) 


Cp/3-l 


2 g 


p = ATMOSPHERIC PRESSURE AT h 
p t = TOTAL PRESSURE AT h 
p s = STATIC PRESSURE 

3. RANDOM INSTRUMENT ERRORS (I cr) 


0<h<‘ 10,000ft Ah = [625 x I0 H0 h 2 + 0.25] ,/2 


10,000 < h * 100,000 ft Ah « [625 x |(f 10 h 2 + lOo] 1/2 
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Error Model for the PRECISION RANGE SYSTEM 


The error model for the precision range system was furnished by Cubic Corp. as being 
representative of the CR-100 system. 

The range correction, aR , for atmospheric refraction was computed from the following 
expressions: 

,-6 


AR = 313 x 10 u I 
e 


where 


1-e 


-ch 


csme 

."Ro.i 


for 0 > 10 


- {-£)'* e (cr e si " 2e)/2 [erf A-erfB] for = < 10° 


A = 


B 


(*— ^ — sin*u + ch ) 

cr ! 

sin 2 s) 2 


c = 1/22,805 ft. 

r e = radius of earth 

1 , 

h = altitude = r ( Rs i n l- + r e ) 2 + R 2 cos 2 S]' 2 - r. 


erf (x) = (^— ) 2 


x 4 x 6 


rl _ — - + _ja_ + i 

11 1 : 3 2 !5 317 ■■■' 


6 = elevation angle at the transponder 

R = slant range 
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PRECISION RANGE SYSTEM (PRS) ERROR MODEL 


ERROR TYPE 

I. RANDOM 
MULTIPATH 

SIGNAL-TO- NOISE RATIO 
PHASE SHIFT DUE TO: 
DYNAMIC RANGE 
TEMPERATURE 
OTHER SOURCES 


MAGNITUDE, ft. (Icr) 

3.0 

1.0 

1.0 

1.0 

0.4 

RSS TOTAL 3.5 


H. BIAS 

CALIBRATION 1.0 

SCALE FACTOR 1.5 PPM 

PROPAGATION ERROR: 

ASSUMED TO BE 20% OF THE COMPUTED RANGE 
CORRECTION FOR ATMOSPHERIC REFRACTION 
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Error Model for DME and MACDME 


The DME error is modeled as the sum of two components: and r n > The 1-sigma value 

of B n is 840 feet. The 1-sigma value of r n is 12 feet (references 2, 3, 4 and 5). 

The MACDME (Maximum Accuracy Compatible DME) error is modeled in much the same way 

as DME except that the roles of B and r are reversed. The 1-sigma values for B„ and r are 
r n n n n 

based on the specifications and on information obtained in private telephone conversations 

with FAA personnel at NAFEC and FAA headquarters. 

The specification for range errors for MACDME requires that it be less than 250 feet 
RMS. It is expected that high quality receivers will be able to use this system out to 
about 25 miles. General aviation will probably find it useful up to ranges of about 
15 mi 1 es . 

The measured ranges for both DME and MACDME were corrected for atmospheric refraction. 
The expressions used are the same as those used for the Precision Range System error model. 
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ERROR MODELS FOR DME AND MACDME 


DME 


ARn = Bn + r n 

B n = Pb B n-I + <r b (l-? b ) l/2 Nl n 
r n = Pr r n-l + oy ^~Pr ^ N2 n 
WHERE : 

AR n IS THE nUl RANGE ERROR SAMPLE 
„ _ - 0.002 AT 

Pb " e 

_ -AT 
P r " e 

cr b = 840 ft 

cr r =12 ft 

AT = TIME BETWEEN SAMPLES 
NI.N2 = UNCORRELATED ZERO MEAN 
WHITE NOISE WITH UNIT 
VARIANCE 


MACDME 


SAME AS DME EXCEPT 
cr b = 25 ft 
<r r = 250 ft 
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Error Model for VOR 


This error model 
random component and 


for VOR bearing error is the sum of two components; a slowly varying 
bias component (references 2, 3, 4 and 5). 



ERROR MODEL FOR VOR 


A/ n = A n +B rs 

A n =/>A A n - 1 +<r A (\-p A z ) l/2 N n 

WHERE : 

A7 n = n— BEARING ERROR SAMPLE 

B rs = 18.67 x icf 3 RADIAN-COMBINED 

RECEIVER /STATION BIAS ERROR (la) 

-cjAT 

PA = e 

a A = 1.57 x IO -3 RADIANS 

u) = 0.7 x 10" 3 V RADIANS /Sec 

V = CRAFT SPEED, knots 

AT = TIME BETWEEN SAMPLES 

N n = ZERO MEAN WHITE NOISE 
WITH UNIT VARIANCE 



Error Models for the FPS-16 and MPS-19 


Tracking Radars 


The error models and locations for FPS-16 and MPS-19 were taken from a Sperry Flight 
Systems report. This report gave RMS values for the random errors but.no information about 
the biases. The biases were assumed to be twice the RMS value of the random error. 

The measured radar ranges were corrected for atmospheric refraction as in the error 
model for the Precision Range System. In addition, a correction, e, was applied to the 
elevation angle to account for bending. This error is a function of the range atmospheric 
refraction correction and is 

e = c cos6&R e 


where 


c .= 1/22,805 

6 = elevation angle at the radar 
AR e = computed atmospheric refraction correction 



ERROR MODELS FOR TRACKING RADAR 


FPS-16 

AZ AND El: 

RANDOM 0.2 m RAD 
BIAS 0.4 m RAD 

RANGE: 

RANDOM 15 ft. 

BIAS 30 ft, 


MPS-19 

AZ AND El: 

RANDOM 0.5 m RAD 
BIAS 1.0 m RAD 

RANGE: 

RANDOM 30 ft. 

BIAS 60 ft. 
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Error Model for RTCA SCI 17 MSBLGS 
(Slide 16) 


This error model is based on the specifications for the RTCA SCI 1 7 MSBLGS. The bias 
values given ostensibly include site errors, but bias errors due to tilts of the mounting 
surfaces around axes other than the axis of measurement appear to have been neglected. 

In addition, no bias value for the DME was given; a value of two feet was assumed. 
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ERROR MODEL FOR RTCA SCI 17 MSBLGS 

SPECIFICATIONS 

AZIMUTH (la-) 

BIAS 0.63 m RAD 
NOISE 0.40 m RAD 

ELEVATION (Icr) 

BIAS 0.87 m RAD 
NOISE 0.61 m RAD 

DME (la) 

BIAS ASSUMED 2.0 ft. 

NOISE 20 ft. 
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Error Model for Instrument Landing System (ILS) 


This slide depicts a continuous model for both ILS glide slope and localizer errors. 

The transfer function given was taken from a Bell Aerospace monthly progress report which 
stated that the model was adequate for both the localizer and glide slope errors when driven 
by a zero mean white noise source with unit variance, N, and variable gain, K. 

A discrete model was derived in the form 



where: <p is a transition matrix relating the state at nth sample to the state at the 

previous (n-l)th sample; and are the zero mean unit variance driving noises. 

W = known matrix. 

This discrete model also required that the error covariance, P, given by 



be preserved, that is, 

P = 0 

This formulation involves evaluation of several very complex constants before equation (1) can 
be employed. These constants will not be given here since a complete description of the model 
is being published in the near future. 



255 


INSTRUMENT LANDING SYSTEM (ILS) ERROR MODEL 


CONTINUOUS ERROR MODEL 


N 

KS 

E r 


(I + I.5S) 2 



N = ZERO MEAN WHITE NOISE WITH UNIT VARIANCE 
E= LOCALIZER OR GLIDE SLOPE ERROR 

ICAO SPECS FOR CAT E ILS 


RANGE (ft) (R) 

E L (lo-)mrad 

e 6 s (lo-)mrad 

3500 > R > 0 

1.4 

1.4 

4.5 NM > R >3500 

. 4.2(R-3500) 

4 + 

23860 

l.l (R-3500) 

1.4 + 

23860 

25 NM > R >4.5 NM 

5.6 

2.5 
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INTRODUCTION 


An inertial navigation system (INS) employing multiple IMUs is being considered for use on 
SSV. Although multiple IMU navigation systems are currently in use, SSV requirements create some 
unique problems with this implementation concept. 

This paper addresses some of these problems. Subjects covered include: 

1. SSV- INS functions and requirements 

2. Background of multiple IMU usage 

3. Candidate IMU configurations and a selected configuration 

4. Identification of the technology areas associated with multiple IMU usage in SSV 

5. Identification of specific areas in which studies are required before the shuttle 
INS implementation is defined 

6. Current MSFC activity in the subject area 

INTRODUCTION 

• FUNCTIONS AND REQUIREMENTS 

• BACKGROUND 

t CONFIGURATIONS 

• TECHNOLOGY TASKS 

• STUDIES 

• 


ACTIVITY 
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FUNCTIONS AND REQUIREMENTS 


The function of the inertial navigation system is to provide vehicle position and attitude 
information during the flights of the Space Shuttle vehicle. In addition, the INS should not 
restrict the attitude of the vehicle during the Space Shuttle mission. The requirement that the 
vehicle have an all azimuth launch capability will place additional requirements on the INS system. 
The INS system must meet a fail operational/ fail operational /fail safe (FO/FO/FS) requirement. 

In addition, it is desirable that checkout of the INS system be performed on-board. In this 
paper FO/FO is assumed to mean that the INS system must function without loss in performance 
after the first two critical failures in the system. The fail safe requirement is understood to 
mean that the INS system must function such that a safe return of the vehicle can be accomplished 
after the third critical failure in the INS system. 

Goals for the INS checkout system should include: provision for having the preflight 

checkout controlled by the on-board computer system; use of built in test equipment (BITE) to 
scan for those failures that are not readily detectable by IMU output comparisons; easy 
serviceability. At this time reliability requirements have not be established. 


FUNCTIONS OF INS 

• PROVIDE VEHICLE VELOCITY AND POSITION DATA 

DESIGN OBJECTIVES FOR THE INS 

• PROVIDE ATTITUDE AND ATTITUDE RATE DATA 

• COMPUTER CONTROLLED ON-BOARD CHECKOUT 

REQUIREMENTS FOR THE INS • GOOD MAINTAINABILITY 

• FAIL OPERATIONAL/FAIL OPERATIONAL/FAIL SAFE • HIGH RELIABILITY 

• SHALL NOT RESTRICT VEHICLE ATTITUDE 

• SHALL NOT RESTRICT LAUNCH AZIMUTH 
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BACKGROUND 


The INS configuration supplied as standard equipment with the Boeing 747 employs three IMUs. 
Among the factors influencing the 747 INS configuration were: The requirement for increased system 

reliability and accuracy over early INS installations; the requirement that the INS equipment 
also provide basic attitude and heading information; and the provision for later adaptation of 
the 747 system to a fail-operational configuration. 

The McDonnell Douglas DC-10 INS employs three IMUs, as does the optional INS package for 
the Lockheed L-1011. 

The Concorde and Boeing 2707 supersonic transport (SST) aircraft both specify INS packages 
employing three independent inertial navigation systems. The use of three independent INS units 
on both of these aircraft is based, to a large extent, on a desire to enhance the overall 
navigation system reliability. The FAA requirements concerning INS accuracy and their requirement 
that one failure must not result in the loss of the aircraft's required navigational capability 
have also impacted the SST- INS designs. 

Studies of candidate navigation systems for an Advanced SST included analyses of two different 
three IMU configurations. One configuration specified that all three IMUs operate continuously, 
whereas the other called for two operating IMUs and one standby IMU. 

A number of studies have included analyses of candidate configurations for the guidance and 
navigation system for the Air Force Space Transportation System - Earth Orbit Shuttle (STS-EOS). 

One recommended system called for three IMUs with backup redundant rate gyros and star trackers. 
Another study recommended that the guidance and navigation system employ four-gimbal IMUs. 

In addition to studies of multiple IMU systems for specific applications, a number of 
analyses of redundancy management and alignment concepts have been made that are directly 
applicable to multiple IMU configurations. 



BACKGROUND 


to 

Cfc 


• AIRCRAFT 

• BOEING 747 

• DC- 10 

• L-1011 

• CONCORDE 

• BOEING 2707 

• ASST 


• OTHER 
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CONFIGURATIONS 


The launch azimuth, no attitude restriction and on-board checkout requirements for the 
Space Shuttle can be met by a simplex IMU system. A simplex system, however, will not meet 
the FO/FO/FS requirement. In general, for one system to meet an FO/FO/FS requirement it must 
be composed of at least four identical components. In addition, a failure detection, isolation, 
and correction (FDIC) system is required to manage the four components in such a manner that the 
FO/FO/FS requirement is met. Note that when only four components are used, the FDIC system 
must be able to detect and isolate a failure when only two components remain. In most FDIC 
systems simultaneous failures present special problems. 

There exist concepts for both the strapdown and four-gimbal IMU systems which have the 
potential for meeting the FO/FO/FS requirement. Some examples that can meet the shuttle INS 
requirements are systems employing redundant strapdown IMUs, the dodecahedron strapdown IMU, 
and the four four-gimbal IMUs. No known operational redundant sensor gimbal IMU exists, however 
some concepts employing this technique are being considered. 

At this stage of the shuttle phase B studies, INS baseline configurations employ four 
four-gimbal IMUs. 

CANDIDATE CONFIGURATIONS RECOMMENDED CONFIGURATION 

• STRAPDOWN 9 F0UR 4 -GiMBAL IMU'S 

• REDUNDANT IMU ' S 

« REDUNDANT SENSOR IMU 

• GIMBAL 

« REDUNDANT SENSOR IMU 


• REDUNDANT IMU'S 
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TECHNOLOGY TASKS 


The on-board checkout operations are divided into three phases: preflight, inflight, and 

postflight. During the preflight phase, the flight readiness of the INS must be verified in a 
way that is consistent with short turnaround time. A minimum amount of ground equipment should 
be required, and there should be high confidence in flight readiness following checkout. Here, 
flight readiness of the INS means verification of the IMUs, IMU interfaces, failure detection, 
and redundancy management functions . Current checkout techniques for IMUs vary with application 
from a manual procedure supported by ground checkout equipment to an on-board computer-controlled 
operation (e.g. Minuteman). 

The typical preflight checkout sequence will include hangar tests, pad tests, and countdown 
checks. Of these, the hangar test will be the most thorough. It will include self-calibration 
and self-alignment checks, combined system tests, servo transient response tests, validation of 
redundancy management functions, and, possibly, optical alignment tests. 

Inflight checkout of the IMUs will also be required, particularly if one or more of the IMUs 
are shut down during non-critical mission phases. Postflight checkout will be used to aid in 
scheduling required maintenance during the turnaround period. 

TECHNOLOGY TASKS 

• ON-BOARD CHECKOUT 

• PREFLIGHT 

• INFLIGHT 

t POSTFLIGHT 
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TECHNOLOGY TASKS (CONT'D) 


In today's aircraft INS systems some on-board automatic system comparisons are performed, 
but the flight crew is involved in the evaluation of proper system operation. The characteristics 
of the shuttle mission point toward automatic IMU failure detection, isolation, and correction 
procedures . 

It is expected that failure detection and isolation can be performed by comparing outputs 
from the IMUs. Additional information, other than normal IMU outputs, such as BITE data, 
external source data (e.g., from star sensors, horizon sensors, radio navigation aids, skewed 
or redundant IMU sensor data, etc.) will also be available to enhance the confidence level of 
the decision process. 

Generally, three types of IMU failures must be considered; soft failures; hard failures; and 
built-in test failures. Of the various failure detection schemes known, only IMU output comparison 
is available throughout the mission and has the capability to detect hard and soft failures. It 
is likely that no single technique will be satisfactory and that multiple error detection 
mechanisms will be used. Practical techniques for comparing IMU outputs in real time while 
operating in a severe environment, such as the boost or ascent phase, have yet to be developed 
and demonstrated. 

The success of a particular failure detection scheme (e.g., voting schemes, statistical 
output estimator/comparator schemes) depends upon the definition of appropriate failure 
detection levels. Sensitivity must be sufficient to detect faulty IMUs before mission require- 
ments are impaired, and the failure detection method must be relatively insensitive to transients, 
noise, and quantization effects. A tradeoff is required between maximum reliability achieved with 
minimum false alarms and allowable system error. Increased reliability may be achieved by use of 
inertial systems whose performance is better than normally required to meet the mission require- 
ments since some performance degradation could be tolerated before the sensor or system must be 
switched out. Through use of an adaptive threshold function it is possible to optimize the trade- 
off between false alarms and undetected failures. The overall system errors then would become 
a function of mission phase. Hard failure detection technology will probably evolve from 
commercial practices that use BITE as the prime means of failure detection. 

To complement the failure detection and isolation system, a redundancy management system 
will be used to decide which of the redundant data from the IMUs is to be used for the navigation 
calculations, and how these data are to be presented. For example, redundant IMU outputs may be 
statistically combined (least squares, average, etc.) and the resulting data would then be 
p-~ ed to the navigation computer. On the other hand, outputs from a single unfailed IMU could 
be passed to the navigation computer. 



TECHNOLOGY TASKS (CONT’ D) 

• FAILURE DETECTION AND ISOLATION 

• BITE (CENTRAL-DEDICATED) 

• OUTPUT COMPARISON 

• COMBINATIONS 

• REDUNDANCY MANAGEMENT 

• COMBINED OUTPUT 


• INDIVIDUAL OUTPUTS 
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SUPPORTING STUDIES 


Some development of these IMUs for shuttle application will be required, but this should 
consist primarily of thermal and mechanical modifications to accommodate the shuttle environ- 
ment. In order to develop the checkout, failure detection and isolation, and redundancy 
management systems associated with the use of multiple IMUs, a number of technical studies should 
be performed. These investigations should include analyses of: 

1. On-board preflight and inflight checkout and diagnostic data requirements 

2. Relative orientations for platform and sensor axes 

• Parallel (vs) skewed platform axes 

• Orthogonal (vs) skewed sensor axes - also redundant sensor axis 

3. Failure detection and isolation methods, including consideration of: 

• Failure scan rates 

• Failure threshold levels defined as functions of mission phase and hardware 

characteristics 

• "Self-healing" techniques (reinstatement of soft failed systems in non-critical 

mission phases) 

. Two IMU failure identification 

• System failure mode and effect analyses - gross investigation of failure modes 

and effects based on a representative IMU in a 4 IMU-INS system configuration 

4. Redundancy management techniques 

Data management impact; error propagation; control system interaction 

5. Effects of dispersal of the IMUs 

Flexible body effects; safety; impact on calibration, alignment, and failure 
detection 

6. Crew interaction/response with the redundant system 

Crew override capability; crew diagnostic functions 

7. Calibration and alignment procedures (preflight and inflight) 

Calibration requirements; schedules and procedures; serial (vs) parallel 
calibration and alignment; updating 

8. Gimbal flip effects - (Non-simultaneous gimbal flip may degrade failure detection) 

While the technology subject in this paper has been focused on the use of multiple IMUs, 
results of the recommended studies will have application to other shuttle subsystems. 
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SUPPORTING STUDIES 

t ON-BOARD CHECKOUT 

• IMU & SENSOR ORIENTATION 

• FAILURE DETECTION AND ISOLATION 

• REDUNDANCY MANAGEMENT 

• IMU LOCATIONS 

• CREW INTERACTION 

• CALIBRATION AND ALIGNMENT 

• GIMBAL FLIP 



CURRENT MSFC ACTIVITY 


MSFC is conducting a study program to define an on-board checkout, failure detection, 
isolation and redundancy management system. This program will investigate those areas previously 
identified as supporting studies and will generate a recommended approach/design for these 
systems. An experimental program is also being prepared to test and demonstrate the recommended 
concepts and to evaluate system parameters such as failure scan rates, failure tolerances, effects 
of IMU errors on failure detection systems, gimbal flip effects, etc. The study is a nine month 
program that will be followed by the "experimental phase. Results of the phase I study will be 
available in early 1972 with experimental results expected by late 1972. 


CURRENT MSFC ACTIVITY 


to t SPONSORING STUDY PROGRAM TO DEFINE 

05 

oo 

t ON-BOARD CHECKOUT SYSTEM 


t FAILURE DETECTION - ISOLATION APPROACH 


t REDUNDANCY MANAGEMENT SCHEME 


• EXPERIMENTAL TEST PHASE 
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1 . Introduction 


Flight control design for the Space Shuttle is compounded by the fact that, effectively, three vehicle con- 
figurations are involved: (1) a mated booster/orbiter combination having c.g. offset and unsymmetrical aero- 

dynamic configurations, (2) an orbital vehicle which must perform both as a spacecraft and as an aeronautical 
vehicle for entry and landing, and (3) a recoverable booster which is also an aeronautical vehicle. Magnitude 
of the flight control problem is typically depicted in the Figure 1 sketch of the McDonnell Douglas/Martin 
Marietta Space Shuttle Configuration in which the booster weighs typically in excess of 3.75 million pounds at 
lift-off and has a landing weight of 700,000 pounds (Ref. 1). The orbiter weighs approximately 840,000 pounds 
at lift-off and 270,000 pounds at landing. Control moments must be generated through various blended combina- 
tions of aerodynamic control surfaces, reaction controls, and thrust vector controls throughout each phase of 
the mission. Autonomous self-test equipment is to be incorporated for low maintenance and fast turn-around 
between flights of the re-usable Space Shuttle system. Principal automatic and manual flight control modes 
must be provided for the following phases of the mission: 

Launch and Ascent Trajectory Guidance 
Separation of Booster & Orbiter 
Orbit Injection 
Rendezvous and Docking 


Orbital Mission 
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Retro-fire 


Entry Energy Management 

(1) Guidance 

(2) Phugoid Damping 

(3) Constraint Limiting - Temp, g, q 
Landing/Go-Around 

To perform these mission phases, complete dependence upon closed-loop control augmentation techniques 
is essential. Integration of flight control and guidance functions is important. Considerable signal 
blending mode variation and use of different control force and moment generation devices are required. Fly- 
by-wire flight control techniques offer the only practical solutions to these requirements. 

For purposes of this paper, fly-by-wire will be defined as a primary flight control system which trans- 
mits command intelligence from the pilot's stick and rudder pedals to the flight control actuators by 
electrical rather than mechanical means. It also includes the concept of a closed-loop control system which 
makes vehicle motion the controlled variable. 

The magnitude of signal processing required and the flexibility desired for various flight phases and 
between missions make digital signal processing highly attractive. Prime candidates are (1) integrated 
avionics having redundant central digital multiprocessors, (2) redundant dedicated digital computers for 
flight control, and (3) digital processors for automatic control and built-in-test functions with redundant 
analog "hardened SAS" control loops for manual control. Since flight control closed-loop designs impact on 
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the total flight safety of the vehicle and interact strongly with other technical disciplines such as aero- 
dynamics, structural, propulsion, flying qualities, guidance, etc., flight control engineers will cringe at 
the thought of being considered "just another set of equations to be processed in a central digital computer." 

Past utilization of digital computers for navigation and guidance functions in aircraft have not had the 
responsibility for instantaneous stability and control augmentation flight safety requirements levied on 
them. Major hardware and software engineering problems remain to be resolved. 

2 . Fly-By-Wire Technology Summary 

First common use of the term "Fly-by-Wire" probably originated with the Mercury capsule which had one mode 
of control which was entirely electrical from the pilot's controller to the reaction controls. Although there 
were a number of studies and breadboard electrical control system investigations prior to the Mercury program, 
the astronauts' messages from space popularized the term "fly-by-wire." Since that time, fly-by-wire (FBW) 
technology has evolved to the point of practical application for primary flight control through a series of 
development programs as shown in Fig. 2. Basically, the components, control laws, and redundancy-monitoring 
techniques developed and verified to date for conventional aircraft have been of an analog or hybrid (discrete 
digital logic elements) mechanization. Control laws implemented with currently available sensors and actuators 
fall naturally into the analog field. Built-in-test and monitoring functions are more easily mechanized with 
digital logic elements which can be greatly miniaturized. However, with the current forms of control sophistica- 
tion and redundancy, the control law and interface electronics may typically account for 40 percent of the elec- 
tronics while the built-in-test and monitoring schemes can account for the remaining 60 percent of the electronics. 
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FIG, 2 FLY-BY-WIRE TECHNOLOGY DEVELOPMENTS 























2.1 Analog Fly-by-Wire Control Systems 

The X-20 Dyna Soar program represented one of the first major developments for fly-by-wire (FBW) con- 
trols in a manned aerodynamic vehicle and was recognized as the only practical solution for the- mission. Elevons, 
rudders, reaction controls, and thrust vector controls were controlled through fly-by-wire signal transmissions 
from the pilot's sidestick and rudder pedals. Both automatic, and manual control modes were available through 
the same FBW equipment. Three forms of longitudinal control laws were selectable by the pilot: (1) a self- 

adaptive pitch rate augmentation system which was based on the X-15 flight experience, (2) a pitch rate aug- 
mentation system with three pilot-selectable fixed gain states, and (3) a manual direct open-loop signal with 
controlled surface position. Reaction controls were automatically blended with aerodynamic controls until a .given 
forward loop gain was achieved in the self-adaptive controller. At this point, the reaction controls were auto- 
m inatically turned off. Fly-by-wire electronics were triply redundant using a majority voting scheme to isolate a 

CJI 

failed channel. FBW actuators were dual redundant. At the conclusion of the program in 1964, most Dyna Soar 
flight control design problems appeared to be solved (with the exception that vehicle structural mode dynamics 
were near the critical self-adaptive limit cycle identification band-width), and the system was packaged in its 
final flight-worthy form (See Fig. 3). Following the termination of the Dyna Soar program, extensive Dyna Soar 
simulation tests were conducted by the Air Force Flight Dynamics Laboratory (AFFDL) for evaluation of the fly-by- 
wire electronics, actuators, and cockpit controls. Test results were very good overall and met basic specifica- 
tion requirements throughout the flight envelope. No failures occurred in the fly-by-wire system over several 
hundred hours of operation in the simulation. Several channel disconnects occurred due to out-of-tolerance 
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tracking problems under large maneuvers, but the channel could be re-engaged by the pilot. Some flying quality 
difficulties were encountered at the transition between hypersonic and supersonic flight regimes where steep 
trim gradient changes occurred aerodynamically . 

Original fundamental FBW developments by the AFFDL attempted to design highly simplified ac controls 
which would require no electronic amplification switching, or shaping. These attempts were unsuccessful due 
to the inability to develop efficient ac torquers for the hydraulic servovalves and the very large, high-power 
LVDT's required for stick position pickoffs when no amplification was permitted. The program was later 
redirected to a more conventional dc electronic form of fly-by-wire, and a triply redundant, single-axis 
demonstrator unit was built. Principal innovation in the Douglas program was the mechanical "median select" 
mechanism incorporated in the servo-actuator. See Ref 2. 

A detailed study of modern analog fly-by-wire technology (components, monitoring devices, system 
mechanizations, and applications) was performed by Sperry Phoenix and is reported in Ref 3. This document is 
a classic for fly-by-wire designers. System design tradeoff factors were described in an attempt to clarify 
the advantages and limitations of competing techniques; particularly performance degradations with various 
failure mode characteristics. Following the study, Sperry implemented a realistic two-f ail-operate demonstrator 
model of a three-axis fly-by-wire control system including simplified built-in-test functions and a triply redun- 
dant, force-shared servo-actuator. Each axis of the system electronics included three active channels and a 
model channel. Under a two-fail-operate status, the three active channel servo-commands are voted. Recently, 
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this demonstrator model was loaned to NASA for modification to a Space Shuttle configuration by McDonnell-Douglas 
and Sperry. 

To gain practical experience with fly-by-wire control, the AFFDL in conjunction with Hydraulics 
Research and Manufacturing Company modified a B-47 aircraft with a non-redundant system in a three phase 
program (Ref. 4 & 5) . First step was to install a FBW actuator in the pitch axis controlled by an electrical 
position pickoff on the normal control column. Flight tests indicated relatively little control difference 
from the normal mechanical control system, except at high q flight conditions, where the electrical system pro- 
vided considerably better control response. Normal mechanical cable compliance, under load, reduced vehicle 
response. Following proof of the FBW actuator, a C* (linear blend of pitch rate, pitch acceleration, and 
normal acceleration) feedback control law was mechanized in the longitudinal axis, and a roll rate loop was 
closed in the lateral axis (See Fig 4). A rather crude, two-axis sidestick was installed to separate the FBW 
control system from the standard mechanical controls and feel system. Pilots quickly gained confidence in the 
system, and performed a series of flying quality tasks to evaluate performance. One of these critical tasks 
involved low-level visual terrain following over a Kentucky ground track. Pilot work load was greatly reduced 
with the closed-loop FBW system and sidestick. Cooper-Harper ratings for this task with the mechanical controls 
were seven or eight as compared to 2.5 to 3.5 with the FBW system. Finally, in the third phase of the program, a 
quad— redundant hydrologic servo— actuator was installed in the longitudinal axis , and inflight failures were 
simulated to evaluate transient response and failure isolation. This was the first flight evaluation of a quad 
servoactuator. During the flight test, the actuator correctly removed all of the failures injected and exhibited 
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no nuisance disconnects. The effects of injected failure during level flight conditions with both hard-over 
and open failures were negligible. Failures inserted while pulling one-half g turns at 400 knots produced 
transients of less than 0.2 g's peak-to-peak with no difference between the first and second injected failure. 
There was no loss of actuator performance with one or two failures. The fail-neutral function was also suc- 
cessfully flight evaluated. The need for non-linear stick characteristics to achieve small precision control 
as well as large maneuvering capability was established in this B-47 program as well as several later flight 
test programs. 

Active aeroelastic control through sensor blending has been in common use on large flexible missiles 
and actively tested in two flight programs for aircraft. Angular rate and/or acceleration sensors located 
strategically throughout the aircraft structure can be used to obtain a desirable feedback signal for control- 
ling multiple force or moment generators for active structural mode control. Fly-by-wire techniques are most 
natural for implementing these functions. The control law can provide a signal related to rigid body control 
exclusive of the structural flexibility dynamics as well as a signal proportional to the structural mode 
motions which are to be controlled. Development programs have included: 

Load Alleviation and Mode Stabilization (LAMS) - An advanced development program has been completed 
by Boeing Company and Honeywell which demonstrated in a B-52 aircraft that advanced flight control techniques 
could be used to alleviate gust and maneuver loads and control structural mode oscillation through the use of 
conventional control surfaces and appropriate control laws (Ref. 6). An optimal control law was derived which 



produced the blended controller. In the longitudinal axis (See Fig. 5) , four rate sensors were employed to de- 
tect bending, two located in the wings to control a .wing bending mode and two located fore and aft in the 
fuselage. In the lateral axis, two roll rate gyros and four yaw rate gyros mounted in the fuselage were used 
to obtain the control signals. All available control surfaces, elevators, ailerons, and spoilers were used to 
provide the necessary moments and forces. Broad-bandwidth (12 CPS) actuators having both mechanical and 
electrical inputs were installed on all surfaces. Flight test results show that significant reductions in 
fatigue damage rates occurred. In addition, a C-5A LAMS analytical study was performed to demonstrate that 
the technology developed for the B-52 could be applied to another aircraft. Conclusions reached from the LAMS 
program are (1) it is practical to design a control system which will provide structural mode control and good 
rigid body stability augmentation compatible with outer-loop modes, (2) multiple sensor blending is required, 
(3) linear optimal control theory must be applied in the design involving multi-variable sensing and control 
generation, and (4) current state-of-the-art actuators can support this technology. A B-52 direct lift control 
mode was also investigated in flight which greatly simplified formation flying for refueling and approach and 
landing. 

Gust Alleviation Structural Dynamics Stability Augmentation System (GASDSAS) - An extensive exploratory 
development program conducted by North American showed that at least two techniques, (1) identical location of 
acceleration sensors and the force application and (2) dual angular accelerometer systems, could be applied 
successfully controlling structural bending of large flexible aircraft. Also, the study showed that interface 
problems between the structural mode control system and outer-loop control modes such as terrain following 




could be overcome. This study led to a joint USAF/NASA flight test of this technique on the XB-70 aircraft 
which demonstrated the effectiveness of this concept. 

Full "man-rating" of fly-by-wire flight control technology is being developed under a major Advanced 
Development Program for Survivable Flight Control Systems by the Air Force. This system which combines two- 
fail-operate, fly-by-wire dispersed analog electronics, and sensors with integrated actuator packages (See 
Fig. 6) will establish criteria for practical application to tactical fighters. McDonnell-Douglas is the 
primary contractor and will install and flight test the system in an F-4E aircraft. The aircraft may be 
controlled either by electrical transducers mounted in the center stick or by a two-axis sidestick through 
closed- loop controls. A direct electrical link is also available to control surface position should three 
"like" closed-loop failures occur simultaneously. Initially, a disengaged mechanical backup control will be 
available in the pitch and yaw axis, but this will be removed in later flights to demonstrate complete confidence 
in the system. Two forms of quad-secondary actuators are being developed to drive the existing stabilator, 
aileron/ spoiler , and rudder power rams. One secondary actuator is electro-hydraulic and the second design employs 
electro-mechanical elements. Considerable design effort is being applied to the redundant electrical and hydraul- 
ic power supplies to insure isolation and protection from single failure points. Design reliability requirements 
for the total systems are failure rates not to exceed X = 2.3 x 10 ^ . 

In a related program, fly-by-wire control laws applicable to large transports operating under low 
altitude turbulent flight conditions will be evaluated in a C-141 flight test by the AFFDL. This system will 
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FIGURE 6 FLY-BY-WIRE TEST INSTALLATION 



depend upon the Survivable Flight Control System program to fully man-rate the fly-by-wire quadruple redun- 
dancy techniques and will concentrate on performance factors for transports attributable to fly-by-wire to 
achieve improved flying qualities. This system, to be developed and built by Honeywell, will consist of a two 
axis, dual redundant, fail-safe set of analog electronics and sensors. Control of the aircraft will revert 
automatically to the normal mechanical system if a failure occurs. A two-axis side stick will be installed on 
the co-pilot's armrest for control of the fly-by-wire system. Feasibility of direct lift control implementation 
through symmetric spoiler control is also being investigated. 

First commercial application of fly-by-wire controls will be the Concorde SST which will employ dual 
analog electrically signalled (command augmentation) and hydraulically, powered systems for primary control and 

a normally disengaged mechanical system as a standby. The design was selected on the basis of pilot flying 

eo 
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at quality requirements and passenger comfort. Length of the aircraft and thermal expansion made design of a 

mechanical primary flight control system which could satisfy the requirements, very difficult. Split elevons 
and rudders, each controlled by a separate servo-actuator, provide safety through the partition principle. 
Servo-valve control is novel in that each servo control is supplied with two electrical inputs and a clutched 
mechanical input. Each signal (electrical and mechanical) can operate the slide valve controlling the actuator 
position. In normal operation, only one electrical signal drives the slide valve, and the second channel oper- 
ates as a "hot spare." In case of identification of failure in the first electrical channel, a transfer to the 
second electrical channel is affected. A second failure transfers control to the mechanical system. Relative 
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comparison of split surface position serves as the monitor function. Flying qualities of the Concorde have been 
reported to be very good in flight tests conducted to date. 

Where flight safety is totally dependent upon electrical fly-by-wire controls, reliability of elec- 
trical wiring and connectors must be given considerably greater design and installation attention than for 
normal avionics equipments. As a result of a considerable number of failures of these components in military 
AFCS installations, a study was conducted by Boeing to establish electrical wiring and connectors design, 
installation, and quality control practices. Results from Apollo and Minuteman high reliability programs and 
a survey of most airframe manufacturers’ wiring practices were incorporated in the report. Particular attention 
was given to the problems of (1) separation of FBW wiring and protection by color coded jackets, (2) junction 
box integrated termination interconnections, (3) selection of suitable electrical connectors, (4) dispersed 
redundant channels and early design routing of wire bundles, and (5) physical and electrical protection for 
wiring. 

Final results are published in a design handbook form (Ref. 7). 

2.2 Digital Fly-by-Wire Control Systems 

Until very recently, digital flight controls for aircraft could not compete with analog techniques due 
to (1) computational speed and slew rate required to achieve sufficient band-width, (2) flight safety factors, 
(3) cost for redundant systems, and (4) the interface with analog sensors and actuators. Greater emphasis on 
more sophisticated automatic controls, increased flexibility for changing control parameters and control laws. 



increased desire for improved built-in-test and monitoring functions, and interface compatibility with hybrid 
navigational and guidance computations makes digital flight controls appear highly attractive, particularly in 
view of achievements in recent airborne digital computer technology. Competition for Boeing's SST automatic 
flight control system produced two advanced digital flight control systems which did much to expand the tech- 
nology in this vital area. However, primary flight control functions in the SST were provided by a triply 
redundant electrical command augmentation analog system and a quadruply redundant hardened analog stability 
augmentation system which provided various levels of degraded performance if failures occurred throughout the 
system. 

Sperry Phoenix was selected by Boeing as the contractor for the SST automatic flight control system. 

M Basically, the system consisted of three general-purpose digital computers having a high degree of monitoring, 

oo 
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failure reporting, and built-in test capability. Sperry Univac 1819A machines were employed. Flight control 
data processors provide D/A and A/D conversions for the computers and its related subsystems. Built-in test 
functions permit detailed checks of element gains, time constants, filters, etc., which provide system checks 
with considerably greater thoroughness than is possible with a basic analog system. Total computer capacity 
is strongly dependent upon the level of built-in-test functions, even more than the control laws incorporated. 
System failures, both ground-based tests and in-flight failures are read out on a pilot's diagnostic panel and 
a flight engineer's printer with instructions of what action should be taken. Considerable automatic flight 
management was programmed into the machine including the Category III all-weather landing capability. 



General Electric also developed triplex digital flight control computers based on variable increment 
computation techniques. These computers were specifically designed for flight control requirements and in- 
clude the capability for performing stability augmentation functions as well as fault detection and some fault 
annunciation. An autoland flight test evaluation of these computers was performed on a Boeing 367-80 airplane 
using control laws derived by Boeing in 1969. Performance was reported to have been very good. 

A digital fly-by-wire flight control system for helicopters is being developed in a joint Canadian/ 
United States program by CAE Industries of Montreal and Boeing Vertol. The triplex system is scheduled to begin 
flight testing this summer in two CH-47C helicopters. 

Data bus concepts for multiplexing multiple electronic subsystem signals on a relatively few trans- 

•g mission lines prompted a study and development of a breadboard multiplexor to determine the requirements for 
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interfacing with analog fly-by-wire flight control systems. Objectives of the study (Ref. 8), which was con- 
ducted by General Dynamics of Fort Worth for AFFDL, were: 

a. Formulate a system which reduces the multitude of wires required for signal transmission, moni- 
toring, and self-test without destroying the benefits of redundancy. 

b. Perform trade studies in which the reliability, survivability, maintainability, weight, and cost 
of various multiplexing concepts are compared. Use a realistic quadraplex fly-by-wire closed-loop flight con- 
trol system for the study. 

c. Select a preferred multiplexed system. 
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d. Design and fabricate a significant portion of the system to permit its demonstration by means of 
breadboard hardware with a simulation. 

Seven levels of multiplexing were applied to the base-line fly-by-wire system in the tradeoff study. 

A configuration in which multiplexing was applied in all signal and discrete monitoring paths was selected, 
and the relative comparison of performance factors with the baseline configuration are shown in the following 
table. A critical design factor is the number and location of monitors in the redundant flight control system. 

TABLE I 


COMPARATIVE FACTORS FOR HARD-WIRED FLY -BY -WIRE SYSTEM VS MULTIPLEXED SYSTEM (Ref 8) 


Reliability 
Survivability 
Availability 
Weight (lbs) 
Cost 


Hard-Wired 
QUAD FBW 

.9999974 

.992593 

.9252 

474.4 

$156,800 


Fully Multiplexed 
QUAD FBW 


.9999948 

.997177 

.9282 

253.3 

$192,360 


The multiplexing technique selected (Ref 8) was a pulse-coded, code divided (Bi-phase Manchester), 


digital data technique employing twisted-shielded pair transmission lines. The design has an update rate of 
400 samples per second based on an assumed maximum flight control band-width of 20 Hertz for future applica- 
tions. Phase lag at 20 Hertz produced by the sum of the data propagation delay and the sample period is 13.3 
degrees. Practicality of the techniques selected were demonstrated in the breadboard mechanization and 



simulation of a three-degree-of-freedom lateral-directional control system of a high performance fighter. 

Figure 7 describes tests of the breadboard multiplexor unit being used to control redundant servo-actuators 
in laboratory bench test. 



. v 


mm 




Fig. 7 - Demonstrator Multiplexed Flight Control System and Actuator 


Realistic flight environment requirements for multiplexed flight control systems will be established 
in a subsequent program in which a flight-worthy breadboard unit will be flight tested on the AFFDL total in- 
flight simulator (TIFS) in 1972. Two-axis pitch and roll controls and monitoring functions will be evaluated. 
Special emphasis is being placed on shielding and EMI requirements. 

Technology for primary digital flight controls including augmentation will be developed under two 
current programs: (1) NASA Flight Research program which will install digital controls in an F-8 aircraft, 

described under a separate paper by Messrs. Burke and Gee, and (2) an AFFDL study and simulation program to 
establish basic digital memory, word lengths, iteration rates, computer organization, and interface requirements 
for tactical fighter multimode flight controls. 

3. Principal Fly-by-Wire Control Technology and Design Problems Anticipated 

From the summary description of the fly-by-wire flight control development and application programs, it can 
be seen that extensive development of analog components, control laws, redundancy techniques, and criteria have 
been or soon will be validated through a series of flight tests. Failure detection and built-in-test elements 
have been mechanized by discrete digital logic elements, but the complexity of these circuits can far exceed 
the component part count required to implement the normal control law circuits applied. In general, digital 
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flight control developments have been successfully applied to ICBM missiles, but digital flight controls for 
aircraft have been limited to automatic flight control functions (outer-loop) and have received only limited 
flight test evaluation to-date. If digital flight controls are to be applied in the Space Shuttle for both 
AFCS and control augmentation stablization of the vehicle, major digital flight control developments and 
flight test verification in representative test aircraft are warranted. Assuming that current digital computer 
technology is adequate to solve the Space Shuttle flight control problem, the following typical criteria and 
requirements must be accurately established before the first flight of the Space Shuttle: 

a. Computation Requirements - Sensitivity of flight control solutions to variations in word length, sample 
rates, bit errors, computer organization, scaling vs signal resolution, dynamic response to change in input sig- 
nals, dynamic filtering requirements (digital vs analog or hybrid), etc. Computer capacity requirements for the 
automatic and manual flight control functions with special emphasis on signal shaping or correction of sensor 
data (i.e., air data signals). Software executive functions. Validate multiplexing techniques with transmission 
of high density traffic data bus avoiding interference of primary flight control signals. Establish compatible 
multiplexed data sampling rate to satisfy both high-speed flight control requirements and low-speed, precision 
navigation and guidance requirements. 

b. Control Laws - Definition of automatic, manual, and emergency flight control laws making maximum use 
of techniques unique to digital solutions. Establish gain changer requirements and select technique to imple- 
ment. Design structural mode active control system or passive filters. Integrate primary flight control sys- 
tem, thrust vector controls, energy management guidance, and automatic landing system. 
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c. Built- In-Test and Failure Detection - Select number, location, and method of monitor functions using 
internal self -monitoring features of digital computers to maximum extent possible. Determine optimum level of 
built-in-test equipment and test signals for the re-usable Space Shuttle mission. 

d. Redundancy - Establish optimum combinations of (1) central processors, (2) dedicated digital flight 
control signal processors, or (3) central processor with redundant analog control loops for manual control to 
satisfy flight safety, reliability, and mission performance requirements. Physical separation of electronic 
equipment and transmission lines is essential. Determination of the levels of redundant sensors and electrical 
and hydraulic power supplies required is an important design factor. Two-fail-operate performance has been 
specified. Thorough failure analysis and test must be conducted. 

e. Criteria - Prepare detailed specification and design handbook for digital flight control hardware, 
software, and interface requirements. 

From previous AFFDL design simulations of manned delta lifting vehicles having broad cross-range maneuvering 
capability (Ref. 9), many flight control problems were investigated which may offer solutions to the Space Shuttle 
control system. In the longitudinal axis, inner-loop fly-by-wire controls were configured as model-following 
pitch rate feedback systems having generally a minimum of three gain states to satisfy flying quality requirements 
from re-entry to touchdown. Gain changes can be implemented either as scheduled functions of inertial velocity 
or q, or as self-adaptive identification. A variety of modern self-adaptive techniques are available which would 
satisfy these requirements. Angle-of-attack command loops were provided for either constant or modulated auto- 
matic control by the energy management guidance system. Safety constraints during re-entry consisted of 
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(1) temperature sensors located at critical nose, wing, and vertical fin leading edges; (2) g accelerometers; 
and (3) q sensors for high speed flight at lower altitudes. Structural mode/flight control interactions can 
be anticipated to be one of the critical design problems of the Space Shuttle as it has been for all other 
large flexible vehicles. Best estimates of the structural mode dynamics should be included in the flight control . 
design from its inception. Since wing loading can be anticipated to be a limiting design factor, full advantage 
of active maneuver load control techniques such as were developed by LAMS and for large booster controls - should 
be applied to minimize structural weight and to alleviate affects of gusts, aerothermalelastic deformations, and 
fuel sloshing. Flight control system/ vehicle bandwidth selection represents a critical design parameter as it 
has significant impact on the design of the digital computation solution rates, multiplexing techniques, actuators, 
and sensor designs. The closed-loop bandwidth initially selected should be sufficiently broad to provide stability 
augmentation, gust alleviation, and active structural mode control. Bandwidth can easily be reduced but it is 
very difficult to increase bandwidth once actuator designs have been frozen. Iterative vehicle configuration/ 
flight control design variations should be investigated to achieve the optimum combinations. 

In the lateral-directional axis, some of the orbiter configurations are characterized by statically unstable 
directional characteristics and also relatively low rudder effectiveness during hypersonic flight due to blanket- 
ing of the center line fin at high angles of attack. Characteristically, delta re-entry vehicles have exhibited 
large adverse yaw characteristics due to aileron displacements and inertial cross-axis coupling terms. 

Directional controls in hypersonic flight will be strongly dependent upon large reaction controls. Roll 
attitude control can be provided by a blend of aerodynamic and reaction controls . Decoupling of the roll-yaw 
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interactions and blending of the aerodynamic and reaction controls can readily be accomplished by the fly-by- 
wire control system, but the specific control laws to be implemented in the lateral-directional control axes 
represent sizable design challenges. Stability of the lateral-directional control will be a strong function 
of angle of attack and may be a limiting factor at certain Mach numbers. Tight sideslip control is essential 
throughout the flight envelope. 

Primary flight control actuators will represent a sizable design problem due to (1) the extremely large 
hinge moments required to drive the large control surfaces needed to generate adequate control moments, 

(2) stiffness constraints to avoid surface flutter, (3) minimization of weight, and (4) temperature constraints 
on the hydraulic fluid. It appears that considerably greater safety and reduced size actuators would result 
from the use of split surface flight controls. Redundancy could be carried through to the actual control surface. 
Monitoring and comparison of the split control surface displacement would ease failure detection. No single fail- 
ure points should exist. Static and dynamic loads on each actuator would be lessened. Temperature loads on the 
actuators and hydraulic fluids caused by aerodynamic heating and internal working energy must be carefully analyzed. 
Temperature limits on conventional hydraulic fluids are being pressed to the extremes in conventional fighter air- 
craft. 

Interface of the fly-by-wire controls with the primary actuators, accomplished either directly with redundant 
monitored servo-valves or by secondary actuators which in turn drive the valve, is important. Interface of the 
actuator with the multiplexed data base must be carefully analyzed. Small noise levels induced by the D/A units 
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can produce large instabilities within the actuator. Location of the electronics used in conjunction with 
actuator electrical feedback is a principal design problem as phase lags in coding and decoding signals 
around the closed loop can become excessive. 

Flying quality criteria for designing the fly-by-wire flight control system for very large manned re-usable 
boosters and orbiters is lacking. Results published to date by Cornell Aeronautical Laboratory for the AFFDL 
(Ref. 10) concentrated on medium-to-high L/D lifting re-entry vehicles operating in final terminal flight at low 
supersonic, transonic, and subsonic speeds and were based on flight results of the M2-F2 , HL-10 , and X-24 class 
of smaller research vehicles. A working draft specification has been prepared. Current efforts are underway to 
extrapolate the specification requirements to larger vehicles such as the Space Shuttle. Development of the 
Total Inflight Simulator (TIFS) , a turboprop C-131 aircraft modified by the addition of a separate simulation 
cockpit and equipped with a variable stability and control system (See Fig. 8), has been completed and is available 
to provide realistic shuttle flying quality investigations in the landing mode. However, flying qualities cri- 
teria for the ascent, orbital, entry, and transition phases of flight will be dependent upon extensive ground- 
based simulation programs being sponsored by NASA Ames and Marshall Space Flight Center. 

4. Conclusions 

Compound, multi-mode, flight control requirements for the Space Shuttle Booster/Orbiter (having considerable 
flexibility to accommodate (1) variations in mission requirements and payload configurations, (2) heavy demands 
for on-board self-test features to minimize launch and turn-around time for the re-usable vehicles, and (3) inte- 
gration of guidance, control, and thrust vector functions) effectively dictate use of digital multiprocessors and 
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Fig. 8 - Total In-Flight Simulator (TIFS) Configuration 
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fly-by-wire flight control techniques. Major questions exist as to use of integrated avionics having redundant 
central digital processors for all on-board computations vs dedicated digital computers for flight control and 
other functions vs digital processors for automatic control functions and built-in-test with redundant analog 
"hardened SAS" control loops for manual control. The critical question is not can central digital processors 
be implemented to satisfy all flight control requirements (they can) , but rather are we willing to afford the 
cost and time for an advanced development program to solve the myriad of engineering problems of total digital 
flight control hardware and software which remain unanswered or even unknown to satisfy the safety and perform- 
ance requirements for this application. The confidence level for applying digital automatic and primary flight 
controls to aeronautical vehicles is very low today due to lack of flight experience. Solutions can be found 
to these problems, but the Space Shuttle mission is far too critical to afford the numerous "debugging" flights 
typical of most aeronautical flight control systems. Thus, if digital processing is proposed for both automatic 
and manual flight control functions, an advanced development program to design, fabricate, and flight test evalu- 
ate a representative digital flight control hardware and software system on a large transport or bomber aircraft 
is warranted. 

Other principal space shuttle flight control design problems anticipated are: (1) structural/control inter- 

actions; (2) aerodynamic stability variations and cross-axis coupling effects with angle of attack and limited 
aerodynamic control margins and effectiveness at certain flight conditions; (3) flight control actuator power, 
redundancy, and temperature limitations; (4) avoidance of single-fail points in redundant channels; and (5) lack 
of flying qualities design criteria applicable to large vehicles for ascent, entry, transition, and landing. 
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MULTIPLE IMU USAGE IN SSV 



INTRODUCTION 


FUNCTIONS AND REQUIREMENTS 


FUNCTIONS AND REQUIREMENTS 

BACKGROUND 

CONFIGURATIONS 

TECHNOLOGY TASKS 

STUDIES 

ACTIVITY 


FUNCTIONS OF THE INS 

• PROVIDE VEHICLE VELOCITY AND POSITION DATA 

• PROVIDE VEHICLE ATTITUDE AND ATTITUDE RATE 

REQUIREMENTS FOR THE INS 

•FAIL OPERATIONAL/FAIL OPERATIONAl/FAIl SAFE 

• SHALL NOT RESTRICT VEHICLE ATTITUDE 

• SHALL NOT RESTRICT LAUNCH AZIMUTH 


DESIGN OBJECTIVES FOR THE INS 

• COMPUTER CONTROLLED ON-BOARD CHECKOUT 

• GOOD MAINTAINABILITY 

• HIGH RELIABILITY 


BACKGROUND 


CONFIGURATIONS 


AIRCRAFT 

• BOEING 747 

• DC-10 

• L-1011 

• CONCORDE 

• BOEING 2707 

• ASST 


CANDIDATE CONFIGURATIONS 

• STRAPDOWN 

• REDUNDANT IMU'S 

• REDUNDANT SENSOR IMU'S 

• GIMBAL 

• REDUNDANT SENSOR IMU 
•REDUNDANT IMU'S 


OTHER 


RECOMMENDED CONFIGURATION 
• FOUR - 4 GIMBAL IMU'S 



TECHNOLOGY TASKS 


TECHNOLOGY TASKS (CONT’D) 


ON-BOARD CHECKOUT 
« PRE-FLIGHT 
• IN-FLIGHT 


FAILURE DETECTION AND ISOLATION 
•BITE (CENTRAL-DEDICATED) 

• OUTPUT COMPARISON 
•COMBINATIONS 


•POST-FLIGHT 


REDUNDANCY MANAGEMENT 
•COMBINED OUTPUT 
•INDIVIDUAL OUTPUTS 


SUPPORTING STUDIES 


CURRENT MSFC ACTIVITY 


ON-BOARD CHECKOUT 
IMU AND SENSOR ORIENTATION 
FAILURE DETECTION AND ISOLATION 
REDUNDANCY MANAGEMENT 
IMU LOCATIONS 
CREW INTERACTION 
CALIBRATION AND ALIGNMENT 
GIMBAL FLIP 


SPONSORING STUDY PROGRAM TO DEFINE 

• ON-BOARD CHECKOUT SYSTEM 

• FAILURE DETECTION-ISOLATION APPROACH 

• REDUNDANCY MANAGEMENT SCHEME 

• EXPERIMENTAL TEST PHASE 



co 
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A SURVEY OF SHUTTLE CONTROL PROBLEMS 

C.R. Stone and T.W. Chase 

Honeywell Inc. 

St. Paul, Minnesota 



FOREWORD 


This paper is an abridgement of "Development of Control Systems for Space Shuttle Vehicles” 
prepared under Contract No. NAS8-25l8l for the George C. Marshall Space Flight Center. 

The contract was conducted under the direction of Mr. John L. Livingston of the Aero-Astro 
Ballistics Laboratory of the MSFC. 

The report was authored by Messrs. C.R. Stone, T.W. Chase, Milton W. Reed, E.D. Skelley and 
M. D. Ward; Mrs. B.M. Kiziloz; and Dr. G. Stein. Work was performed at the Systems and Research 
Center of Honeywell, Inc., in Minneapolis, Minnesota. 

Data for the North American 130G, 13^+C and 13 ^+D orbiters were used without restriction by 
permission of Mr. A. B. Kehlet of the North American Rockwell Corporation. 


INTRODUCTION 


The table on the following two pages summarizes the results of "Development of Control 
Svstems for Space Shuttle Vehicles". The table is too detailed for use during the oral 
presentation. Work that led to entries in the table is discussed. 



Control Requirements Summary 


1 light Regime 

[ Problem 

Cause 

Solution 

Remarks 

Pitch Launch 

Trim gimbal require- 
nrnr- (up to : 5. 5 deg) 

1 ippth-wise center-of- 
gravity travel 

Mount orbiter more for- 
ward; increase booster/ 
orbiter mass ratio; 
reshape trajectory 

I'p to »5 deg to track center of gravity 
Trajectory shaping may have adverse side effects. 



Aerodynamic forces 

Change booster to 
orbiter to cant angle; 
tailor booster and/or 
orbiter aerodynamics 

Up to :4. 5 to compensate for aerodynamics. 


Perturbation gimbal 
■equirementa (up to 16 
leg) 

Winds 

Control; trajectory 
shaping; vehicle design 

for a statically stable vehicle (which most shuttle configurations appear tn he) 
perturbation gimbal requirements can be required to tl. 5 deg. 


Inflight loads 

Winds 

Control 

Excellent control can generally decrease all inflight loads to 50 percent of those 
achieved with good control. Forward- body- bending moments can be simu)tane>rusiy 
reduced to 25 percent. 


Terminal drift 

Winds 

Control 

There is a modest increase in inflight loads as terminal dispersions are reduced 
from 19. 000 ft to 4 . 000 ft. 

Lateral 1-aunch 

Roll gimbal require- 
ments (up to 1 15 Jeg) 

Side winds and rolling 
moment due to sideslip 

Control 

It is believed better control can reduce this to iS deg. Some roll gimbal slewing 
arrangements increase pitch gimbal requirements. 




Allow the vehicle to roll 
to large angles So the 
wind is resolved into the 
pitch plane 

Pilots may object to the targe roll angles. It may reduce overall control capa- 
bilities because of analytical difficulties. Controller complexity is increased. 




Use ailerons 

Aerodynamic t St ■ ere having difficulties in developing ailerons that are effective 
in the high -dynamic pressure transonic regime where they are required. 




Change gimbal stewing 
arrangement 

Effectiveness of this potential solution is not known. 




Trajectory shaping 

Potential side effects may be adverse. Jt will only be effective for those configura- 
tions using swept-back wings. 




Change booster and/or 
orbiter dihedral ; provide 
more gimbal deflection; 
increase booster base 
area 

can be made aero at a particular point on the trajectory. It ia a strong function 
oftne center of gravity, so this reduces rather than eliminates the difficulty. 

Changing dihedral will have adverse effects in other flight regimes. The decision 
to provide only »7 deg has been made. This will increase roll effectiveness by 
increasing gimhal moment arms. The drag increase would decrease orbital payloads. 


Yaw gimbal require- 
ments (up to *£ deg) 

Side winds 

Control 
Vehicle design 

It ia believed better control can reduce these requirements to *3 deg. 
Increasing directional stability would decrese yaw gimbal requirements. 


Inflight loads Sid* winds Control Loads sir* demonstrated to be sensitive to control policy. It is believed improve- 

ments of excellent control over good control would be similar to that achieved for 
pitch control. 


r > I -..4. I r'nnfrAi I This in nnl a aimiflcant oroblem. 



Orbiter Pad Abort Collision- free launch Clearances between Nos* thruster, orbiter Weight penalties of additional force procedures; mechanical problems in achieving 

booster and Launch tilt tilt, 

tower in wmds 


irbiter Inflight Abort Control increase mflignt Not fully resolved Provision for inflight abort of the orbiter bas major implications on the orbiter 

envelope control and guidance. Problems appear to be resolvable without major revisions 

of the vehicles or their control, but detailed invert! gat loos are necessary. 

Section V of this report examines some of the problems and presents some solutions 


t>rbiter Entry 


Directional stability of 
single vertical-tailed 
orbiter* 

Control 

Guidance demands are small. Controls. must be designed to meet minimal require- 
ments to avoid wasting propellant. 


... 1 


Vehicle design 

The twin vertical- tailed orbiter* can rely on aerodynamics. They appear to be 
currently unpopular because of large binge moments at Ugh- dynamic pressures. 

Orbiter Subsonic Flight 

None 



Una fomented airframes have inherently p»d handling characteristics. Control 
augmentation to meet handling qualities specifications is minimal. 

I'npowered Orbiter Land- 
ing 





'Spec" type 

High landing speeds snd 
large flight path angles 

Small vehicle lift-drag 
ratio and compatibility 
for manual landing 


All known efforts for landing fly s constant -speed approach on the "fro** aide" of the 
power required curve. This provides the beneficial effects of inherent apeed 
stability and large control power. The adverse effects are steep approach peths 
(above 10 deg), high approach speeds, and high landing speeds. 

"Non-spec" type 

Reduced Roll Power 

Manual flight in high 
winds not possible 

Small control surface 
rate capabilities 

Control 

For the case of a delta-wing orbiter that ia examined in Section VO. aileron and 
rudder rates can be reduced from 20 deg/ sec and 6 deg/ sec to 3 deg/ sec and 3 deg / 
sec. respectively. It ie believed these reductions imply large increases in orbital 
payload. 

Shallow Approaches 

Manual flight would be 
difficult 

Pilot has to control botl 
height and speed 

i Control 

Approach would be at 3 deg and be compatible with conventional IL£ equipment. 
Approach initiation speed would be very high. Touchdown speed would be clone 
to stall. The lower landing apeed would decrease braking requirements and 
increase orbital payload. 


























OVERVIEW 


The five statements present a succinct (though overly simplified) overview. 

OVERVIEW 

NO PROBLEM IN LAUNCH PITCH CONTROL 
LAUNCH ROLL GIMBAL EXCESSIVE 
ABORT DESIGNS THE ORB ITER TVC & ECS 
NO PROBLEM IN SUBSONIC HANDLING 
SPECIFICATIONS COST WEIGHT 



LAUNCH CONTROL 


The MSFC Vehicle B Booster/Orbiter (circa January 1970) is used for the boost phase results 
presented. This shuttle has a gross takeoff weight of 3-5 million pounds. Control is achieved 
by vectoring the 13 rocket engines on the booster. 

Time-varying perturbation control is considered. Pitch and lateral motions are assumed to 
be uncoupled. 

The pitch axis is disturbed by Vaughan-Skelton winds normal to the flight path. The Vaughan- 
Skelton winds are also used as side disturbances. For rolling gusts the NASA specification* 

wind of the Dryden form is used with a scale length of 1750 ft. and of the same magnitude as for 
the Vaughan-Skelton wind. The effects of roiling gusts are negligible. 

The Vaughan-Skelton wind is made up of mean and random components. The mean wind is taken 
O 

Co to be the E-W component of the March wind at Cape Canaveral as tabulated by Vaughan**. Random 

winds are generated by Skelton's *** time-varying second-order differential equation model of the 
"Dryden" form that fits Vaughan's covariance data. 


Staff of the NASA Flight Research Center, "Preliminary Flying Qualities Specification for 
Space Shuttle Vehicles," January 28, 1970. 

** 

Vaughan, W.W. , Interlevel and Intralevel Correlations of Wind Components for Six 
Geographic Locations," NASA TN D- 56 I, December i 960 . 

***Skelton, G. B. et al, "Design of a Load Relief System," Honeywell Final Report 12013-FR1 
prepared under Contract NAS3-201‘;5 to the George C. Marshall Space Flight Center, May 9? 196 c. 



MSFC SHUTTLE VEHICLE B 
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LAUNCH PITCH CONTROL 


Evaluation of nine pitch controllers is presented. Seven of these controllers were synthesized 
by use of conventional control techniques (guided by experiences with control of Saturn class vehicles), 
and two were subsequently developed from quadratic control theory. 

Single sample analog simulations were performed for the seven conventional controllers. This 
was accomplished by generating a "synthetic wind" by simulating the Vaughan-Skelton differential 
equations-. Samples of the random wind and the mean wind were stored on magnetic tape. 

Covariance analyses on all nine controllers were performed. 

The figure shows the maximum perturbation values of n^ (normal acceleration at the pilot's seat), 
q Q, and A (gimbal deflection). 

Normal acceleration at the pilot's seat is insignificant. Vectorial addition with the axial 
boost acceleration does not significantly change the pilot's acceleration. 

For q Q and A the covariance results are always more severe than those obtained from the single- 
sample analog simulation. This was unexpected because the one sigma single-sample wind has a 3 a peak 
near maximum q. 

Comparative performance of the conventional controllers shows generally the same trend character- 
istics as determined by simulation and covariance analyses. The result for q a for the q a controller 
is one of the exceptions. 

Maximum allowables for the responses of the vehicle were not known. The quadratic controllers 
were synthesized to reduce all inflight responses uniformly. The 15th iteration quadratic achieves 
poorer inflight performance than the 13th because its terminal drift is lower. 



PITCH CONTROL 



DAMPER 
ATTITUDE 
SCHED AH 
SCHED ATT 

DRIFT 
ACCELEROMETER 
q<* RELIEF 
13TH QUAD 
15TH QUAD 


*OE G 
4 





n IT ~ FT/SEC 2 
0 n 4 8 




LAUNCH PITCH CONTROL 


Maximum bending moments at three body stations are shown. They generally display the same 
trend characteristics as for n^ and q u. An exception is noted for the forward body bending 
moment. Here the quadratic controllers were only able to achieve a 25 percent reduction below 
that attained with the best conventional control. 



PITCH CONTROL BENDING MOMENTS 


AFT BODY 

~10 6 IN. LB ~10 6 
Q 50 100 15 0 
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LAUNCH PITCH CONTROL 


Terminal drift is shown. Most noteworthy is the extremely low value achieved by the 

4 

conventional minimum drift controller. Its drift feedback is 3 x 10 larger than the maximum 
value used for the 13th iteration quadratic controller. This in part accounts for its poorer 
inflight performance. However, most of its poorer inflight performance is attributed to its 
use of the same inner loop feedback gains as are used in the pitch attitude controller. 

We conclude the pitch control presentation with the observation that the perturbation 
q a can be maintained below 24*00 deg-psf (|/l| + 3 CT ) with less than + 1,5 deg. of gimbal. In- 

flight loads are selectively and collectively subject to reduction by good control techniques. 
Terminal drift (|jij + a) is reduced from 19,000 ft. to 4,000 ft. at the expense of inflight 


demands . 



PITCH CONTROL TERMINAL DRIFT 


Z (T>~ FT 

0. 01 0. 1 1 10 10 2 10 3 10 4 10 5 




LAUNCH LATERAL CONTROL 


Evaluation of five conventional lateral axes controllers is presented. The roll axis control 
for all five employed the same roll rate and roll angle feedbacks. 

The roll gimbal deflection (fc ) and the yaw gimbal deflection (* ) generate uncoupled roll and 
yaw torques, respectively. 

Single-sample analog simulations and covariance analyses are performed on all controllers. 
Results for gimbal requirements are shown oh the accompanying figure.' Comparative performance 
shows generally the same trend characteristics as determined by simulation and covariance analyses. 
The result for yaw gimbal requirement for the q $ is an exception. Covariance results are again 
more severe than those obtained from analog simulations. 

Yaw gimbal requirements are marginally aceptable. They can be met with less than 7 deg. 
of gimbal. 

Roll gimbal requirements are excessive. Even with mean wind biasing on the drift controller, 
the 3 ct covariance result implies that + 13.5 deg. are required. 

Roll gimbal requirements are generated by the rolling moment due to sideslip. It is believed 
(based on experience with the pitch axis) roll gimbal requirements can be reduced to + 5 deg. The 
roll gimbal requirement can also be reduced by allowing the vehicle to roll. 
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LATERAL LAUNCH CONTROL 
GIMBAL DEFLECTION 


DEG 


W HU 


HEADING 

DRIFT 

BIASED DRIFT 
ACCELEROMETER 
qp RELIEF 



PEAK ROLL 
TORQUE 



Inflight loads are shown. They are significantly affected by controller type. 


co 
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LATERAL LAUNCH CONTROL 
INFLIGHT LOADS 


AFT BODY 



IN. LB 


HEADING 
DRIFT 
BIASED DRIFT 
ACCELEROMETER 
q/» RELIEF 



FORE BODY 

~10 6 IN. LB 
0 10 20 30 



q /S PSF DEG 
1000 3000 




1 XT 


Terminal drifts are shown. 


They are acceptably small for all controllers. 


We conclude that lateral drift requirements are easily achieved. The maximum value of 
p can be maintained within 2100 deg-psf. For the controllers analyzed, yaw gimbal require- 
ments are marginal and roll gimbal requirements are excessive. Xt is conjectured gimbal 
requirements can be reduced markedly with better control. 

LATERAL LAUNCH CONTROL 
TERMINAL DRIFT 


y (T) ~ FT 




THREE-ENGINE ORBITER INJECTION 


A linear fixed-gain thrust vector controller was designed. It utilizes angular rate and 
angular displacement feedbacks about each axis. Adequate stability is achieved throughout 
the nominal injection flight envelope and at reduced power levels (including engine out). 


THREE-ENGINE ORBITER 





ENTRY CONTROL SYSTEM 


(NAR 134D SINGLE TAIL AWO) 

Elevons are sufficiently effective that they can be used for pitch and roll control. The 
rudder is ineffective and the directional stability is negative. Hence, an attitude control 
propulsion system is used to generate yaw torques. 

The control system is a conventional gain-scheduled system with command signal limiting. 
Linear switching with a deadband control of the yaw ACPS is used. 


ENTRY CONTROL SYSTEM 
(SINGLE TAIL AWO) 

AERODYNAMIC PITCH AND ROLL CONTROL 

ACPS YAW CONTROL 

GAIN SCHEDUlfD SYSTEM (q, M) 



ENTRY CONTROL 


The sideslip must be maintained within a very small range because the directional stability 
is negative, the aileron yawing moments are adverse, and the yawing authority is limited. Side 
slip is maintained within a small range by limiting maneuver rates through command signal 
limiting of aileron displacement. 

ENTRY CONTROL 

PROBLEM SOLUTION 

KEEP |p| < 0.75 DEG |& a | < 2.5 DEG 

C < 0 
n fl 

C > 0 
6 a 

YAW AUTHORITY 
AC PS FUEL 


REMARK 

ACPS FUEL = 1350 LB 


DEADBAND 




ORB ITER PAD ABORT 


Thrusters at the orbiter nose or orbiter tilt provide alternative methods for achieving 
collision free lift off the orbiter. Numerical values cited are for the NAR 134C or D delta 
wing orbiter and for the NAR 130G straight wing orbiter. 

ORBITER PAD ABORT 
SOLUTIONS 


MECHANISM AWO SWO 

NOSE THRUST- LB 19,000 27,000 

NOSE TILT -DEG 4.0 7.5 
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INFLIGHT ABORT 


(FOR THE NAR 1;ID SINGLE TAIL, TWIN-ENGINE ^WO) 

Inflight abort of the orbiter increases the size of the flight envelope over which the vehicle 
is required to operate. Thrust vector control is required over a much larger flight envelope than 
for nominal injection, and the entry flight regime is increased. 

The consequence is the requirement that the control system be effective over a larger range of 
vehicle parameters and for more demanding input commands. Abort considerations influence the 
design of both the thrust vector control system for injection and the entry control system (ECS). 

Satisfactory control during abort is achieved by modification to the TVC and ECS, by tailoring 
guidance commands, by fuel tank sequencing, and by providing additional fuel tank baffling. 

The abort trajectory, on which these results are based, is indicated at 226,956 ft., at 10,308 fps, 
at 6 deg. flight path angle. Launch is to the northeast. The abort trajectory is for recovery 
in Canada. Two engines are operative for 142 sec. The orbiter then operates on single engine 
to 332 sec. 

Satisfactory abort control was achieved with the control system described on the following page. 



INFLIGHT ABORT CONTROL 

SIMULTANEOUS OPERATION OF 

THRUST VECTOR CONTROL SYSTEM 
ORBIT ROLL AND PITCH CONTROL SYSTEM 
ENTRY CONTROL SYSTEM 

NOMINAL TVC MODIFIED 

POWER LEVEL GAIN ADJUSTMENTS 
COMMAND SIGNAL LIMITING 

ORBIT ROLL CTRL REQUIRED FOR SINGLE 
ENGINE TVC 



ABORT CONTROL 


The system was simulated near the abort initiation point. Pitch and roll commands were 
applied. Limit cycles occurred because of actuator rate saturation at 10 deg/sec. Provision of 
the command signal limits shown below eliminated the limit cycles. 

ABORT CONTROL 

PROBLEM: TVC LIMIT CYCLING WITH PITCH 

OR ROLL COMMANDS 

CAUSE: ACTUATOR RATE SATURATION 


CURE: 


COMMAND SIGNAL LIMITING 


< 2 DEG/SEC 

< 5 DEG/SEC 

< 4 DEG/SEC 



ABORT CONTROL 


Significant forces normal to the vehicle occur during early portions of the abort. These 
would not be present during nominal injection. 

The normal forces present unusual fuel sloshing problems as is indicated on the following 
figure. More extensive tank baffling would probably provide a solution, but more extensive 
modeling and analysis are required. 

INFLIGHT ABORT 




'(THRUST - AXIAL FORCE) 



ABORT CONTROL 


For nominal operation the main and orbit propellants are used sequentially. This yields 
an aft c.g. location at the time the main propellant has been consumed. The problem outlined 
below occurs as a consequence. 

ABORT CONTROL 


PROBLEM: THE ORB ITER DIVERGED IN PITCH 

AT 240 SEC 

CAUSE: AFT C.G. 

CURE: CHANGE FROM SEQUENTIAL BURN 

OF MAIN AND ORBIT PROPELLANTS 
TO PARALLEL BURN 



ABORT CONTROL 


The problem of transition from single engine thrust vector control to control with the 
entry control system is outlined below. 

ABORT CONTROL 


PROBLEM: CONTROL AT SINGLE ENGINE 

BURNOUT AT 332 SEC 


CAUSES: 5 DEG OF P DURING SINGLE ENGINE 

OPERATION 

0.75 OF/3ECS CONTROL AUTHORITY 


CURE: 


DECRAB AT BURNOUT 



ABORT CONTROL 


Guidance commands were developed from point mass trajectories. Simultaneous pitch 
and roll commands were called for at Jly sec. The orbiter diverged. Initiating a lp 
ramp pitch command at 700 sec. cured the divergence. 

ABORT CONTROL 

PROBLEM: DIVERGENCE AT 715 SEC 

CO 

CO 

CAUSE: SIMULTANEOUS PITCH AND ROLL 

COMMANDS 

CURE: REV I SE THE GU I DANCE COMMAN DS 


up 

sec. 



LATERAL HANDLING CAPABILITIES 
OF A STRAIGHT WING ORBITER 


Data for the North American (NAR) 130G straight wing orbiter are used for this study. The 
130G has 

© a conventional rudder 

• differential stabilizer operation (for ailerons) 

• slow acting spoiler ailerons. 

The basic (unaugmented) aircraft meets NASA specs with ailerons and rudder except for 

• marginal roll rate oscillations from aileron commands at moderate dynamic pressure 

• excessive proverse sideslip during moderate dynamic pressure flight 

w • marginal roll effectiveness at landing. 

co 

eo 

With control augmentation the aircraft meets level 1 requirements with ailerons and rudder. 
It meets level 3 requirements with spoilers and rudder. 
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HANDLING CAPABILITIES 
BASIC AIRFRAME CHARACTERISTICS 

FLT. CONDITION 
Mach 

Speed ~ fps 

Dynamic pressure ~ psf 
Altitude ~ ft. 

DEFICIENCIES (* ~ * ) 

'a r > 

Roll Rate Oscillations 
Proverse Sideslip 

Bank Angle Response 


MODERATE q 

LANDING 

O.65O 

0.226 

674 

252 

287 

75-5 

20,000 

0 
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HANDLING CAPABILITIES 


The lateral response differential equations contain 11 free and independent parameters. 
NASA flying qualities specifications* provide 11 independent requirements. Hence, an ideal 
aircraft response model can be defined. 

By use of the specification, numerical values for the parameters are chosen to be 


uu, = 1 
d 

l/T, - 0 

itjvw) ■ 0 

(P /c ) = -.5 

' nr r'ss 

These values are used to determine the 
the following page. 


^d = 1 

L p = -2.5 

AP max = -°35 


T r = .75 
( u ,^) 2 = 1 . 

hJ'Jse = ‘ 2 - 


(p /c ) 
v 'm' r ss 


-.2 


coefficients in the ideal response model shown on 


-K- 

Staff of NASA Flight Research Center, "Preliminary Flying Qualities Specifications for 
Space Shuttle Vehicles," January 28 , 1970* 




HANDLING CAPABILITIES 


A model following controller is designed to enforce correspondence between the model response 
and the aircraft response. The block diagram is shown on the following page. 

In principle, control gains could be determined by a number of methods. The method of Stein 
and Henke* is used here and is found to be most efficient. 

By using this procedure, a controller is designed, and it is established that level 1 
requirements can be met with ailerons and rudder. Level 3 requirements can be met with spoilers 
and rudder. 


to 

to 

to 


*Stein, Gunter and Henke, Allen H., "A Design Procedure and Handling-Quality Criteria for 
Lateral-Directional Flight Control Systems, "Technical Report AFFDL-TR-70-152, Air Force Flight 
Dynamics Laboratory, February 1971. 



340 


HANDLING CAPABILITIES 
HANDLING QUALITY CONTROLLER DESIGN 


PILOT 

COMMAND 

MODEL 


LATERAL AND 

RUDDER 

COMMANDS 

(c a' V 



HANDLING 

QUALITY 

MODEL 


\ 



VEHICLE 




FINAL CONTROLLER 


ACTUATOR 
| INPUTS 
(AILERON, 
RUDDER, 
SPOILER) 

P (u , u , u ) 

' a' r' s 

— .... .. . 

AIRCRAFT STATES 




ROLL POWER REQUIREMENTS 


Smaller actuator rate capabilities are sought. Achievement would increase orbital payload 
by reducing the hydraulic power and weight. 

Smaller actuator rate requirements would be achieved by designing to the intent rather than 
to the letter of NASA specifications. For landing, aileron rate requirements could be reduced 
from 20 deg/sec. to 3 deg/secj rudder rate could be reduced from 6- deg/sec. to 3 deg/sec. 

Surface rates are presently determined by’ the requirement for 30 deg. of roll in 2.5 sec. 
The intent of the specification is control in turbulence. With a good controller the NAR 134D 
orbiter at 172 ' kt and 600 ft. altitude in specification turbulence has rms dispersions in bank 
angle of 0.t3 deg, heading of 0.80 deg, and lateral displacements of 2.0 ft. This demonstrates 
that the intent of the specification can be met with small rate capabilities cited. 





ROLL POWER REQUIREMENTS 


The controller used is of the low pass type. This assures that flexure modes will not be 
excited. 

Open and closed loop pole positions for those poles that can be affected by control are 
shown. 

ROLL POWER CONTROL SYSTEM ROOTS 

X OPEN LOOP 
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ROLL POWER REQUIREMENTS 


The left strip shows the sidestep response of the controller designed for control in 
turbulence. Response time is 6 sec. 

Control in turbulence (with the magnitude of rolling turbulence at six times the specification 
value) without surface saturation limits is shown in the right strip. Maximum surface rates are 
below 6 deg/sec. Maximum values of lateral displacement (y), heading (H), and bank angle ( 0) are 
below 7 ft, 3 deg, and 3 deg. 


ROLL POWER 





0 --VVA^AA^/^^ 



ROLL POWER REQUIREMENTS 


eo 

CJ1 


Control in turbulence with surface rate saturation limits of 2.86 deg/ sec is shown. For 
400 sec the aircraft is controlled with dispersions, only slightly larger than without saturation. 
At 400 sec. the system breaks into a limit cycle oscillation. With larger saturation limits 
the system is divergence free. 


ROLL POWER 
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DESIGN PRINCIPLES FOR A SPACE SHUTTLE DIGITAL AUTOPILOT 

Richard Gran 

Research Department 
Grumman Aerospace Corporation 
Bethpage, New York 11714 
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ABSTRACT 


The synthesis of a digital autopilot for the Space Shuttle, in all phases of operation, can proceed in an or- 
derly way of using the fundamental dynamic equations of motion. This approach uses many recent developments 
in the theory of control system synthesis. In particular, the theories of ’’Linear Optimal Control,” "Optimal 
Linear Estimation, ’’ and "Pole Matching” are used to provide answers to some commonly asked questions. For 
example, one can answer the following: 

• What is the sampling rate for the control system ? 

• What can be expected for the computation time ? 

• What is the simplest autopilot that will do the job? 

The exposition attempts to exploit the relationship between the "modern” design approach and the classical 
design techniques of synthesis (i.e., pole-zero design, bode plot, and compensation techniques). Some of the fea- 
tures of the resulting autopilot are : 

• Simplicity of Design - available design computer programs are used throughout. Trial and error design 
is eliminated. 

• A systematic way of arriving at the sampling time is provided. 

® The configuration that yields the minimum computation time is readily identified. 

• Many different avenues for design simplification can be easily exploited. 

• Sensitivity to parameter variations can be easily explored. 
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DIGITAL CONTROL SYSTEM DESIGN 


1. DESIGN PROBLEMS 

• SAMPLING TIME 

• CONTROL SYSTEM CONFIGURATION 

• SYSTEM MODELLING ACCURACY 

- STATISTICS 

- DYNAMICS 

• COMPUTATION OF CONTROL GAINS AND COMPENSATION 

2. IMPLEMENTATION PROBLEMS 

• MINIMIZATION OF COMPUTATION TIME 

• MINIMIZATION OF STORAGE 

• COMPUTER INTERFACE WITH CONTROL SURFACES 



SAMPLING TIME 


One of the stumbling blocks to the appreciation of the capability of digital control systems has been the in- 
sistence upon sampling the environment at "twice the highest frequency" contained in the dynamics describing the 
environment. A stubborn application of this "rule of thumb" leads to unrealistically fast sampling times in situa- 
tions that do not require them. Using this simple example, it can be seen why this "rule of thumb" is not neces- 
sary and, in fact, is really misleading. 



SAMPLING TIME 


03 


BASED ON THE SAMPLING THEOREM, A "RULE OF THUMB" HAS BEEN 
"SAMPLING TIME SHOULD BE APPROX 10/f MAX " 

IN PRACTICE ONE MAY SAMPLE MUCH SLOWER. THE REASON IS THAT 
THE SAMPLING THEOREM SPECIFIES THE MINIMUM INFORMATION ONE 
HAS TO HAVE TO RECONSTRUCT A SIGNAL FROM ITS SAMPLES. IN 
CONTROL PROBLEMS A GOOD MODEL OF THE SYSTEM EXISTS. THIS 
MODEL MAY BE USED TO EXTRAPOLATE FROM SAMPLE TO SAMPLE. 


EXAMPLE: 

SYSTEM MODEL: 
x + ax = au OR U(s)-> 


s + a 


X (s) 


ui CONTROL a = TIME CONSTANT x^OUTPUT 
FOR A KNOWN u(t) WE CAN SOLVE 

x(t) = e‘ a ' V x(t Q ) + e' a(t ‘ t) u (t) At 




THE TRUE LIMITATION ON SAMPLING TIME IS OUR 
IMPRECISE KNOWLEDGE OF THE SYSTEM 
i.e. UNCERTAINTY 


When the uncertainty in our knowledge of x(t) exceeds some value, - determined by the control system ac- 
curacy requirements - then a sample must be made to lower this uncertainty. The uncertainty in the state can be 
determined a priori by propagating the covariance matrix with initial value of zero, and the time when the ele- 
ments of the matrix exceed some preselected value will determine the sampling time. 



THE TRUE LIMITATION ON SAMPLING TIME IS OUR 
IMPRECISE KNOWLEDGE OF THE SYSTEM 
i.e. UNCERTAINTY 




CONTROL SYSTEM CONFIGURATION 


The closed loop system configuration uses the "Separation Theorem". We assume the system is adequately 
described by linear dynamics, and design a Kalman Filter and an optimal control gain. The resulting block dia- 
gram is shown here. The noise n, may be a colored noise, in which case the filter is devised using an augmented 
state model. 


CONTROL SYSTEM CONFIGURATION 



SYSTEM 

OUTPUT 


CONTROL COMPUTER 


"REAL WORLD" 



u = Kx WHERE x = E| x | MEASUREMENTS j 

THIS IS THE "SEPARATION THEOREM". WE ASSUME LINEARITY. 




CLOSED LOOP SYSTEM DYNAMICS 

1. SYSTEM MODEL IN CONTINUOUS TIME 

x = Ax + Bu + C n i (1) 

y = Hx + Gnj (2) 

2. SYSTEM MODEL IN DISCRETE TIME 

a) SOLVE (1) FOR ANY t, , 

THEREFORE x(t 1 )= <I> (t, - 1„) x (t 0 ) + J 1 <I> (t, - r) EBu(r) + Cn,] At 

b) ASSUME: f o 

• t„ = LAST SAMPLE • t, = PRESENT SAMPLE 

i.e. IF T = SAMPLE TIME, t Q = KT, t, (K + 1) T 

• u(r) AND n, ARE CONSTANT OVER t Q - t, 

THEN: 

x [<K + 1)T1 =<I>(T)x(KT) + DBu(KT) + DCn 1 (KT) 

WHERE D =f T 3 >(T-t) At, Y k = H x (KT) + G n 2 (KT) 
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CLOSED LOOP SYSTEM DYNAMICS (CONT) 


*K + 1 


"$(T) 

— 

DBK 


*1 

A 

+ 

DC 

-K+1 

L. w-i 


TH 

<J>(T) + DBK 


-K 


0 


^2n VECTOR 

K IS CONTROL GAIN 


JSl 


n 


2 


4. r IS SOLUTION OF “MATRIX RICATTI EQUATION'' 

K CAN BE OBTAINED BY: oo 

a) OPTIMIZING A PERFORMANCE INDEX J= / (x' Qx + u'Ro) dt 

0 

b) POLE MATCHING 

5. USING 4b) 

e PERMITS SENSITIVITY TO BE CONSIDERED 

• ALLOWS CLOSED LOOP SYSTEM TO BE SIMILAR TO OTHER 
BOOSTERS 



x> 


BLOCK DIAGRAM OF KALMAN FILTER 





e (KT) - RESIDUAL. ALSO CALLED INNOVATIONS PROCESS 
r FOR OPTIMAL CASE, e f (t) IS WHITE NOISE 

OPTIMAL ESTIMATE, AT TIME KT 


<x 
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Z -TRANSFORM OF THE OPEN LOOP, COMPENSATOR, 
AND CLOSED LOOP SYSTEM 


This set of figures, from Reference 1, shows the results of designing a control system using the optimal 
control approach. One of the problems is that the design could be overly sensitive to the assumed plant model. 
The use of pole matching allows a set of closed loop pole locations to be selected based on considerations which 
will give a better sensitivity. 
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BY TAKING THE Z-TRANSFORM OF THE CLOSED LOOP 
SYSTEM ONE MAY ANALYZE THE SENSITIVITY OF 
THE DESIGN USING ROOT LOCUS IDEAS (DESIGNED 

BY W. WIDNALL): OPEN LOOP 

» 



DIGITAL AUTOPILOT DESIGN FOR RE-ENTRY (NO-AERODYNAMICS) 
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BY TAKING THE Z-TRANSFORM OF THE CLOSED LOOP 
SYSTEM ONE MAY ANALYZE THE SENSITIVITY OF 
THE DESIGN USING ROOT LOCUS IDEAS (DESIGNED 
BY W. WIDNALL): COMPENSATOR (OPTIMAL) 



DIGITAL AUTOPILOT DESIGN FOR RE-ENTRY 



TAKII 
STEM ' 
IE DES 
r W. Wl 
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FUTURE WORK 


• ANALYZE NON-LINEAR SYSTEM 

- LINEARIZE SYSTEM IN REAL TIME (ABOUT CURRENT ESTIMATE) 

- USE SOME FORM OF ACTUAL NON-LINEAR FILTER 

- DISCOVER THE NATURE OF CONTROL & ESTIMATION SEPARATION 

• COMPARE NON-LINEAR IMPLEMENTATION WITH LINEAR 

- DOES THE ADDITIONAL COMPLICATION "PAY"? 

• COMPLETE DESIGN OF ALL DIGITAL AUTOPILOT PHASES 

- BOOST (SEPARATION INCLUDED - SHUTDOWN - IF ANY) 

- ORBITAL (RENDEZVOUS - DOCKING - STATION KEEPING ETC) 

- RE-ENTRY 

- LANDING (AERODYNAMIC PHASE) 
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NASA FRC DIGITAL FLY-BY-WIRE FLIGHT-TEST PROGRAM 


Equipping the space shuttle vehicle with a digital fly-by-wire flight control system has been discussed within NASA. 
The past and present space programs have demonstrated performance and reliability of such a system in a space 
environment; however, only limited actual flight data in an atmospheric environment are available on which to 
base confidence in the performance of such a system. 

A technology development program is underway at the NASA Flight Research Center that should provide information 
on the performance of digital fly-by-wire systems for aerodynamic control. This program, which utilizes an F-8C 
aircraft as a flight-test vehicle, is being conducted in two phases. Phase 1 is the development and flight testing of a 
single-channel digital system with a triple redundant direct electrical backup system. Phase 2 is the development and 
flight testing of a redundant all digital fly-by-wire system. 

The mechanical flight control system will be deactivated for this program. 



NASA FRC DIGITAL FLY-BY-WIRE 
FLIGHT-TEST PROGRAM 

F-8C AIRCRAFT 


PHASE 1 

DEVELOP AND FLIGHT TEST A SINGLE-CHANNEL DIGITAL FLY-BY-WIRE 
SYSTEM WITH A TRIPLEX DIRECT ELECTRICAL BACKUP SYSTEM 

PHASE 2 

DESIGN, DEVELOP, AND FLIGHT TEST A REDUNDANT ALL DIGITAL 
FLY-BY-WIRE SYSTEM 
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PHASE 1 CONFIGURATION 


For the Phase 1 configuration, hardware from the Apollo program is used for a primary single -channel digital 
system. This hardware is space proven in terms of reliability and performance. 

The pilot' s inputs are sensed by position transducers on the pilot' s controls and fed to the Apollo guidance 
computer (AGC) as well as the triple redundant backup system. The desired response of the vehicle is computed in 
the computer and compared with the measured aircraft motion from the Apollo IMU. The error signal is used to 
further change the aircraft motion until the desired response is achieved. 

The triple redundant backup system is a direct mode for surface control. It might be noted that, because this 
system will be on an F-8C, it will not be necessary to provide stability augmentation; the inherent stability of the 
vehicle, and therefore surface command, is adequate from a flight safety standpoint. 

The system utilizes the secondary actuator concept in that the redundant secondary actuators control the position 


of the control surface power actuators. 



PHASE 1 CONFIGURATION 


DIGITAL PRIMARY CHANNEL 
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DIGITAL SYSTEM PITCH CONTROL LAWS 


The pilot will have the option of selecting one of three different control laws in pitch and roll and one of two 
different control laws in yaw. The control laws are programed on the AGC and are selected by means of a mode 
control and monitoring panel in the cockpit. 

For pitch control, the command augmentation mode (CAS mode) will provide improved handling qualities for the 
F-8C aircraft. The pilot’s stick input is filtered and shaped to a desired C* response, and this signal is compared 
with a blend of the actual pitch rate and normal acceleration of the vehicle. The difference between these signals, 
or error signal, is fed to a D/A converter, and the analog signal is used to drive the elevator actuator. The 
error signal is reduced to zero through the closed-loop dynamics of the airframe. The integral bypass permits 
passage of the higher frequency signals for maneuvering flight and also permits the desired steady state C* 
response. The pilot also has a trim capability. 

In the SAS mode, elevator position is controlled by the pilot. Pitch rate feedback is summed with the pilot's 
input to provide a simple pitch damper. 

In the Direct mode, there is no rate feedback and operation of the controls is similar to operation with a direct 
mechanical linkage. 

It might be of interest to note that attitude rates are derived from the gimbal angles, and the rates are then 
converted from attitude to body axis. 



DIGITAL SYSTEM PITCH CONTROL LAWS 


W 

-3 


CAS MODE 


NORMAL 
SAS MODE 


DIRECT MODE 









DIGITAL SYSTEM ROLL CONTROL LAWS 


The Roll Rate Command (RRC) mode is implemented to improve the roll handling qualities of the F-8C. In this 
mode of operation, the pilot' s input commands a desired roll rate. Integral bypass is again used to give the 
desired roll rate response. 

The mechanization of the roll SAS and roll Direct modes is similar to that for the pitch SAS and pitch Direct 


modes. 



DIGITAL SYSTEM ROLL CONTROL LAWS 


RCC MODE 



SAS MODE 

SIMILAR TO PITCH 
DIRECT MODE 

SIMILAR TO PITCH 







DIGITAL SYSTEM YAW CONTROL LAWS 


In the SAS mode, rate and acceleration are fed back to provide some yaw axis static stability and damping. The 
washout circuit in the rate feedback loop causes the rate signal to go to zero during steady-state turns. Rudder trim 
is provided, and an interconnect is added to improve the handling qualities of the F-8C. 


The Direct mode is rudder surface position command. 



DIGITAL SYSTEM YAW CONTROL LAWS 


SAS MODE 


AILERON COMMAND 



DIRECT MODE 


SIMILAR TO PITCH 





FAILURE DETECTION IN PRIMARY SYSTEM 


The reliability and performance of the failure detection and switching logic determine the reliability of the total 
system. The philosophy used in this concept is that one failure in the digital channel causes an automatic switch to 
the backup channels. The pilot can override the automatic switching circuit at any time. There is a comparator (C) 
at the output of redundant stick position LVDT' s. If the outputs differ, the system switches into backup. 

The Apollo digital computer has internal monitoring of the computer (AGC), coupling data unit (CDU), and the 
inertial measuring unit (IMU). If a malfunction is detected in any of these units, the system switches into backup. 

The dual parallel outputs of the digital computer are used to drive servovalves and monitors for the right and left 
secondary actuators for the pitch or roll control surfaces. If the active and monitor signals differ, the system switches 
into backup. 

The position feedbacks from the primary and backup channel LVDT' s are passed through a voter. The primary 
LVDT is also fed back to the monitor valve to protect against failure of the voter. 
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FAILURE DETECTION IN PRIMARY SYSTEM 
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TRIPLEX BACKUP ELECTRICAL FLIGHT CONTROL SYSTEM 


The mechanization of only one of the three redundant channels of the triplex backup system is shown. This con- 
trol loop is a control surface position loop. The output of the stick position sensors is passed through a voter and 
fed directly to driver amplifiers for the secondary actuators where actuator position and, hence, control surface 
position, is fed back. 

Because of control law difference between the primary and backup systems, the signal to the primary servo may 


03 

-a 

oo 


be different from the signal for the backup. The function of the integrator in the circuit is to store the difference 
between the primary and the backup and to add this difference to the backup servo to synchronize the backup servo 
with the primary servo. The trim input is a "beep" trim and is normally zero. 



TRIPLEX BACKUP ELECTRICAL FLIGHT CONTROL SYSTEM 


STICK POSITION 
SENSORS 


LVDT 


LVDT 


LVDT H— 



TWO OTHER CHANNELS SAME AS ABOVE 
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ACTIVE -STANDBY/ FORCE SUM SERVO ACTUATOR 


The secondary actuator is a three-piston-ram configuration operated from a dual hydraulic system. The monitor, 
active, and number 3 valves share one system, and the number 2 and number 4 valves share the other system. 

The active -standby concept is used when the system is in the primary mode of operation. The active valve has 
complete authority of the ram, and the transfer valves for the three backup channels are closed. The signals to 
these valves, however, are synchronized with the signal to the active primary valve and are therefore ready to take 
over when a transfer is made. 

If a first failure occurs, a difference will exist between the active and monitor valve and the transfer valve to 
the active valve closes with the simultaneous opening of the three valves for the backup system. The output force of 
the ram then becomes the sum of the forces of the three pistons. 

If a second failure occurs, it is detected by a difference in one of the differential pressures that are monitored at 
the backup servovalves. The malfunctioned channel is then shut off. 

If a third failure occurs, it is detected by a difference between the two remaining differential pressures. When 
this occurs, both channels are automatically shut off. The pilot is then required to determine which of the two 
remaining channels is good and manually engage it. 



ACTIVE-STANDBY/FORCE SUM SERVO ACTUATOR 
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LOCATION OF DISPLAY PANELS 


Two control and display panels are located in the cockpit for the flight control system. 

The Digital Mode Select Panel is at the top center of the instrument panel. This panel contains controls for 
alinement of the IMU and selection of the individual control modes: C*, SAS, and Direct for pitch; RRC, SAS, and 
Direct for roll; and SAS and Direct for yaw. The panel also provides failure monitoring of the IMU and the AGC. 

A System Status Panel for the backup system is located on the left-hand console. This panel contains monitors 
of the electronics and servo valves for each axis in each channel of the backup system. Selector switch features for 
each servo valve permit the pilot to override the automatic switching function of the flight control system. 



LOCATION OF DISPLAY PANELS 






REDUNDANT ELECTRICAL POWER SYSTEM 


The electrical system for the fly-by -wire system will be completely independent of the aircraft primary electrical 
system. An independent gear-driven dc generator will supply the FCS bus. Each system is then independently run 
from a separate bus which is backed up by a battery. For further backup operation, the FCS bus can also be switched 
to the main aircraft dc bus or emergency dc bus, if required. 



REDUNDANT ELECTRICAL POWER SYSTEM 
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HYDRAULIC FUNCTION DIAGRAM 


The existing hydraulic system in the F-8C aircraft is a dual redundant system with a ram air turbine (RAT) on 
the number 1 system. The reliability and power capability are adequate for the fly-by-wire flight control system; 
therefore, modifications to the hydraulics will be limited to those necessary to implement the new active -standby 
actuators that replace the present secondary actuators which were only dual redundant. The number 2 hydraulic 
system will be shared by the digital primary and the number 3 backup systems. The number 1 hydraulic system 
will be shared by the number 2 and number 4 backup systems. 



HYDRAULIC FUNCTION DIAGRAM 
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NASA FRC DIGITAL FLY-BY-WIRE FLIGHT-TEST PROGRAM SCHEDULE 


Phase 1 was approved at the beginning of the calendar year. 

The preliminary studies and system definition effort are paper studies of systems, cost, and schedules. 

In the design and simulation phase, system design studies have started with a computer simulation of the system. 
As the hardware becomes available it will be added to the simulation. The final ground simulation will utilize much 
of the actual hardware. This hardware will be installed in the grounded aircraft using the same bracketry and 
installation techniques as will be used in the flight vehicle. Systems response tests, including frequency and 
structural responses, and functional and operational tests will.be conducted. 

The Phase 2 effort is undefined at this time, and the dates shown are desirable target dates for the program. 
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NASA FRC DIGITAL FLY-BY-WIRE 
FLIGHT-TEST PROGRAM SCHEDULE 


PHASE 1 

PRELIMINARY STUDIES AND 
SYSTEM DEFINITION 

DESIGN AND SIMULATION PHASE 

FABRICATION PHASE 

PREPARATION FOR AND FLIGHT 
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PHASE 2 

SYSTEM DEFINITION 
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FABRICATION AND GROUND TESTS 
FLIGHT TESTS 
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EXPECTED RESULTS 


The expected results of this program would be a higher confidence level in fly-by-wire control systems through 
actual experience with an operational system. The flight testing of a fly-by-wire system with no mechanical system 
for backup would be a significant breakthrough in control systems technology for the aviation community. 

Specifically, the digital system should provide experience in multichannel operation, a demonstration of digital 
techniques, operational reliability, fault detection, and self-correcting features. 

As a result of this effort, we will have a versatile system that can be used for research to advance the state-of- 
the-art of digital flight control systems. 



EXPECTED RESULTS 


DIGITAL FLY-BY-WIRE 

EXPERIENCE WITH MULTICHANNEL OPERATION 

DEMONSTRATION OF SYSTEM UTILIZING REPRESENTATIVE COMPUTERS 
OPERATIONAL RELIABILITY 
COMMON FAILURE MODES 

FLIGHT CONTROL SYSTEMS RESEARCH 

A VERSATILE SYSTEM WILL RESULT THAT CAN BE USED FOR GENERAL 
RESEARCH OF DIGITAL CONTROL SYSTEMS 



